Senior Application Security Engineer (Burp Suite DAST)

phia, LLC; United States; Remote; USD 140.000 - 190.000; Vollzeit

Benefits dieser Stelle

Medical Insurance

Vision Insurance

Life Insurance

Short Term Disability

Long Term Disability

401k Retirement Savings Plan with 100%

Paid Holidays

Paid Time Off (PTO)

Tuition and Professional Development

Zusammenfassung

phia LLC seeks a Senior Application Security Engineer (Burp Suite DAST) to run the enterprise DAST program and integrate scanning into CI/CD in a federal-friendly environment. You will work in Linux, implement security controls, and align with NIST/FedRAMP standards while supporting modern development pipelines.

The role requires 3+ years with Burp Suite DAST, 2+ years with Veracode SAST, and strong coding skills in Java or Python. This is a remote US position with standard working hours.

Qualifikationen

• 3+ years running Burp Suite DAST / Burp Enterprise scans in enterprise environments.
• 2+ years Static Application Security Testing (SAST) with Veracode or similar Tools.
• 3+ years with Java, Python, .NET or C# in enterprise settings.

Aufgaben

• Run Enterprise DAST: configure, schedule, and run dynamic scans including authenticated scans.
• Integrate scanning into CI/CD pipelines within development environments.
• Work in Linux environments and troubleshoot connectivity impacting scanning.
• Design and implement enterprise-wide security controls for applications and infra.
• Map findings to OWASP Top 10, CVSS, CWE, WASC, and align with NIST 800-53, FIPS, FedRAMP.

Kenntnisse

Burp Suite DAST

Linux

Java

Python

C#

CI/CD security integration

Ausbildung

Bachelor's degree preferred

High school diploma or GED

Tools

Veracode

Jobbeschreibung

If you are unable to complete this application due to a disability, contact this employer to ask for an accommodation or an alternative application process.

Senior Application Security Engineer (Burp Suite DAST)

Operations US

4 days ago Requisition ID: 1055

Status: Active – Immediate Need

Location: Remote – U.S. Only

Focus Areas: Burp Suite DAST (Enterprise), Veracode SAST, CI/CD Security Integration, Linux, and Federal Application Security Testing

Overview

At phia we hire talented and passionate people who are focused on collaborative, meaningful work, providing technical and operational subject matter expertise and support services to our partners and clients. phia is seeking a mission-driven Senior Application Security Engineer to act as a dedicated technical partner embedded within a federal financial regulatory agency’s application security team.

You will run the enterprise application security testing program — automated dynamic scanning with Burp Suite DAST (formerly Burp Suite Enterprise Edition) — integrate scanning into development pipelines, and work in Linux environments to keep scans healthy. This is a hands‑on engineering seat for someone who has operated an enterprise Dynamic Application Security Testing (DAST) program, not only manual testing with Burp Suite Professional.

What You’ll Do

• Run Enterprise DAST: Configure, schedule, and run dynamic application security scans with Burp Suite DAST (Enterprise), including authenticated scans across the application portfolio.
• Integrate the Pipeline: Build and maintain scan integrations in development environments and CI/CD pipelines (e.g., Eclipse, JDeveloper, Veracode pipeline scanning).
• Work in Linux: Navigate Linux/UNIX systems and troubleshoot basic website connectivity issues that affect scanning.
• Design Security Controls: Design and implement enterprise‑wide security controls for applications, systems, networks, and infrastructure services.
• Apply the Standards: Map findings to OWASP Top 10, CVSS, CWE, WASC, and SANS-25, and align work to NIST 800-53, FIPS, and FedRAMP.

Who You Are

• Enterprise DAST Practitioner: 3+ years running Burp Suite DAST / Burp Enterprise scans — not only Burp Suite Professional.
• Veracode SAST User: 2+ years of Static Application Security Testing (SAST) experience, including Veracode and its pipeline integration.
• Coder: 3+ years with Java, Python, .NET, or C#.
• Linux-Comfortable: 3+ years in Linux/UNIX, including troubleshooting connectivity.
• Controls Designer: You have designed enterprise‑wide security controls.
• Federal-Aware: Familiar with NIST 800-53, FIPS, or FedRAMP.

Required Qualifications

• 6+ years of Information Technology experience, with experience in cybersecurity or application security.
• 3+ years of experience with Java, Python, .NET, or C#.
• 3+ years of experience using Burp Suite DAST to perform Dynamic Application Security Testing (DAST).
• 2+ years of experience with Static Application Security Testing (SAST), using tools such as Veracode.
• 3+ years of experience designing and implementing enterprise‑wide security controls to secure applications, systems, networks, or infrastructure services.
• 3+ years of experience with Linux or UNIX environments, including system navigation and troubleshooting basic website connectivity issues.
• 2+ years of experience with Veracode and development environments such as Eclipse or JDeveloper, including pipeline development and integration.
• Experience securing enterprise web applications and frameworks, including OWASP Top 10, CVSS, CWE, WASC, and SANS-25.
• Knowledge of federal security and compliance standards, including NIST 800-53, FIPS, or FedRAMP.

Preferred Skills

• Experience with Interactive Application Security Testing (IAST) capabilities and tools.
• Burp Suite DAST experience is pivotal in this position (required)

Required Education + Clearance

• Education: High school diploma or GED required; Bachelor’s Degree preferred (Experience can be substituted for education).
• Clearance: Public Trust / Suitability; applicants selected will be subject to a security investigation.

GENERAL PROGRAM REQUIREMENTS:

• Citizenship: Must be a U.S. Citizen. No exceptions.
• Work Hours: Expected 8.5-hour work day (with a 30-m inute break) within c ore hours approximately 7:30 AM – 4:30 PM US Eastern Time ( ET ) , Monday through Friday ; daily standup at 8:30 AM ET; schedule is flexible with advance notice.
• Work Location: Fully remote within the United States.
• Travel: Minimal.

Who We Are

phia LLC ("phia") is a Northern Virginia based, small business established in 2011 with focus in Cyber Intelligence, Cyber Security/Defense, Intrusion Analysis & Incident Response, Cyber Architecture & Capability Analysis, Cyber Policy & Strategy, Information Assurance/Security, Compliance, Certification & Accreditation, Communications Security, Traditional Security, and Facilities Security. phia also provides cyber operations support functions such as: Program and Process Management, Engineering, Development, and Systems Administration that allows for Cyber Operations to efficiently integrate our customer's missions and objectives. phia supports various agencies and offices within the Department of Defense (DoD), Federal government, and private/commercial entities.

phia offers excellent benefits to enhance work-life balance, including the following:

• Medical Insurance
• Vision Insurance
• Life Insurance
• Short Term & Long Term Disability
• 401k Retirement Savings Plan with Company Match
• Paid Holidays
• Paid Time Off (PTO)
• Tuition and Professional Development Assistance

phia does not discriminate on the basis of race, sex, color, religion, age, national origin, marital status, disability, veteran status, genetic information, sexual orientation, gender identity, or any other reason prohibited by law in the provision of employment opportunities and benefits.