Senior Application Security Engineer - Secure CI/CD & WAF

Tier4 Group; Reston (VA); On-site; USD 120,000 - 160,000; Full time

Job summary

Tier4 Group in Reston, VA, seeks a Senior Security Engineer to design, implement, and operate security controls across applications and platforms. The role emphasizes embedding security into SDLC and CI/CD pipelines, strengthening web/API protections, and proactive detection, while collaborating with development, DevOps, and operations teams to build secure-by-default services.

You will lead policy development, implement controls, and tune WAF rules, conduct vulnerability assessments, and drive

Qualifications

• 6–8 years of enterprise application security experience.
• Hands-on with web app security and OWASP Top 10.
• Experience with WAF/API security, container security, and image scanning.
• Conduct web app security assessments or pen tests.
• Experience with OAuth/OpenID authentication services.
• Experience operating on-prem or cloud security platforms.
• Strong problem solving and cross-functional communication.

Responsibilities

• Develop and maintain application security policies and controls.
• Partner with DevOps to secure CI/CD pipelines.
• Design and operate WAF and API protections; tune rules and automate policy updates.
• Identify vulnerabilities, perform risk assessments, and provide mitigations.
• Develop security monitoring for the application stack.
• Lead technical investigations of security incidents.
• Engage with senior stakeholders to interpret risks and priorities.

Skills

Application Security

OWASP Top 10

WAF/API Security

Vulnerability Assessments

OAuth/OpenID

On-Prem/Cloud Security

Incident Investigations

CI/CD Security

Security Monitoring

Stakeholder Communication

Education

Bachelor's Degree in Information Security or Computer Science or Computer/Electrical Engineering

Tools

WAF

Vulnerability Scanners

CI/CD tooling

Cloud Security Platforms

Job description

Tier4 Group in Reston, VA, seeks a Senior Security Engineer to design, implement, and operate security controls across applications and platforms. The role emphasizes embedding security into SDLC and CI/CD pipelines, strengthening web/API protections, and proactive detection, while collaborating with development, DevOps, and operations teams to build secure-by-default services.

You will lead policy development, implement controls, and tune WAF rules, conduct vulnerability assessments, and drive