Senior Application Security Engineer - DevSecOps Lead

SciTec; Boulder (CO); On-site; USD 98,000 - 146,000; Full time

Benefits offered by this job

401(k) match

HSA Medical insurance

Dental insurance

Vision insurance

Life insurance

Long-term Disability insurance

Hospital Indemnity insurance

Accident and Critical Illness

Short-term Disability

Profit-Sharing Plan

Parental Leave

Paid Time Off

Flexible Work Hours

Job summary

SciTec, a Firefly Aerospace subsidiary, seeks an Application Security Engineer to secure mission-critical software in a DevSecOps setting. You will perform static and dynamic reviews, tooling integration, and collaborate with developers to embed security into the lifecycle.

The role requires 2+ years in application security, understanding of secure SDLC, and the ability to obtain a DoD/DoE clearance. Colorado-based position with strong benefits and growth opportunities.

Qualifications

• Bachelor's degree plus 2+ years of professional experience in cybersecurity or software development, or equivalent experience.
• 2+ years of experience focused on application/software security.
• Experience analyzing source code for security flaws.
• Familiarity with secure software development practices.
• Strong analytical, problem-solving, and communication skills.
• Detail-oriented with strong written and verbal communication abilities.
• Ability to qualify for and maintain a DoD or DoE Secret security clearance.
• Ability to meet DoD 8140.01 Cyberspace Workforce Management requirements within six months of hire.
• Good verbal and written communication skills.
• Attention to detail.

Responsibilities

• Perform application security analysis using both automated and manual techniques, including: Static code analysis (SAST), Software composition analysis (SCA), Fuzzing, Manual code and design reviews.
• Identify, analyze, and help remediate application vulnerabilities.
• Support software engineers in integrating security considerations into system and application designs.
• Integrate and maintain application security tooling within CI/CD and DevSecOps pipelines.
• Design, implement, and improve continuous integration security analysis tooling.
• Tune and maintain security tools to reduce false positives and improve signal quality.
• Assist development teams in understanding findings and implementing effective fixes.
• Support threat modeling and secure design reviews.
• Stay current with emerging vulnerabilities, attack techniques, and mitigation strategies.
• Document findings, recommendations, and best practices.
• Perform other duties as assigned.

Skills

C++

Python

JavaScript

Rust

Education

Bachelor's degree in a relevant field

Tools

Coverity

Klocwork

SonarQube

Snyk

Sonatype

Anchore

JFrog Xray

AFL

honggfuzz

strace

eBPF

Ghidra

IDA Pro

Job description

SciTec, a Firefly Aerospace subsidiary, seeks an Application Security Engineer to secure mission-critical software in a DevSecOps setting. You will perform static and dynamic reviews, tooling integration, and collaborate with developers to embed security into the lifecycle.

The role requires 2+ years in application security, understanding of secure SDLC, and the ability to obtain a DoD/DoE clearance. Colorado-based position with strong benefits and growth opportunities.