Senior Application Security Engineer: SDLC & Mentoring

Booz Allen Hamilton; Bethesda (MD); On-site; USD 87,000 - 198,000; Full time

Job summary

Booz Allen Hamilton is seeking an Application Security Engineer in Bethesda, MD to weave security into the software development lifecycle and mentor teams. You will support client engagements, perform threat modeling, and evaluate secure software architectures across cloud-native environments.

The role requires 5+ years in cybersecurity or related fields, hands-on experience with SAST/DAST/SCA, and the ability to communicate risks to executives.

Qualifications

• 5+ years in cybersecurity, application security, product security, or software engineering.
• Experience leading client engagements and architecture reviews, threat modeling, or security assessments.
• Knowledge of SBOMs, dependency management, code signing, artifact integrity, and secure build pipelines.
• Experience with Agile, Scrum, and DevSecOps in large-scale software environments.
• Understanding of cloud-native architectures, microservices, APIs, containers, Kubernetes, and serverless.

Responsibilities

• Integrate security practices throughout the software development lifecycle.
• Translate complex technical risks into executive briefs, business cases, and roadmaps.
• Mentor and supervise team members and lead security-focused client engagements.

Skills

Cybersecurity experience

Secure SDLC knowledge

Threat modeling

Executive communication

Mentoring

Education

Bachelor's degree in CS/Cybersecurity/Info Systems/Engineering

Master's degree in Cybersecurity/CS/Software Eng./Info Assurance

Tools

SAST

DAST

SCA

IaC scanning

Container security

API security

Secrets detection

Job description

Booz Allen Hamilton is seeking an Application Security Engineer in Bethesda, MD to weave security into the software development lifecycle and mentor teams. You will support client engagements, perform threat modeling, and evaluate secure software architectures across cloud-native environments.

The role requires 5+ years in cybersecurity or related fields, hands-on experience with SAST/DAST/SCA, and the ability to communicate risks to executives.