Senior Application Security Lead DevSecOps Flexible Hours

SciTec Incorporated; Boulder (CO); On-site; USD 155,000 - 185,000; Full time

Benefits offered by this job

401(k) match

Company-paid Health Insurance

Discretionary Performance Bonus

Paid Parental Leave

Flexible Work Hours

Life Insurance

Long-term Disability

Vision Insurance

Dental Insurance

HSA Medical Insurance

Job summary

SciTec Incorporated is seeking an Application Security Engineer Lead to secure mission-critical software for DoD programs. You will guide hands-on security analysis, embed security in development, and collaborate with software engineers to strengthen CI/CD pipelines.

The role requires 8+ years in cybersecurity or software development, DoD security clearance, and strong code-analysis skills. Join a fast-paced team delivering OPIR data processing for national defense, with comprehensive benefits.

Qualifications

• Bachelor’s degree plus 8+ years of professional experience in cybersecurity or software development, or equivalent experience.
• 2+ years of experience focused on application/software security.
• Experience analyzing source code for security flaws.
• Familiarity with secure software development practices.
• Strong analytical and problem-solving skills.
• Detail-oriented with strong written and verbal communication abilities.
• Ability to qualify for and maintain a DoD Secret security clearance.
• Ability to meet DoD 8140.01 Cyberspace Workforce Management requirements within six months of hire.
• Ability to effectively collaborate with government customer team members and other engineers.
• Active DoD Secret clearance or higher.
• Experience identifying, exploiting, and remediating application vulnerabilities.
• Credit for published CVEs is a strong plus.
• Proficiency in C++, Python, JavaScript, Rust.
• Experience configuring and operating static analysis tools (Coverity, Klocwork, SonarQube).
• Experience configuring and operating software composition analysis tools (Snyk, Sonatype, Anchore, JFrog Xray).
• Experience with fuzzing frameworks (AFL, AFL++, honggfuzz, or similar).
• Experience with debugging, runtime instrumentation, or reverse engineering (strace, eBPF, Ghidra, IDA Pro).
• Familiarity with threat modeling methodologies and frameworks such as MITRE ATT&CK.
• Experience working in DevSecOps or Agile development environments.

Responsibilities

• Perform application security analysis using both automated and manual techniques, including SAST, SCA, fuzzing, and manual reviews.
• Lead an application security team in support of multiple programs.
• Identify, analyze, and help remediate application vulnerabilities.
• Support software engineers in integrating security into designs and CI/CD/DevSecOps pipelines.
• Design, implement, and improve continuous integration security analysis tooling.
• Tune and maintain security tools to reduce false positives and improve signal quality.
• Assist development teams in understanding findings and implementing fixes.
• Support threat modeling and secure design reviews.
• Stay current with emerging vulnerabilities and mitigation strategies.
• Document findings, recommendations, and best practices.
• Perform other duties as assigned.

Skills

Application security

Code analysis

Secure SDLC

Analytical skills

Communication

Security clearance

DoD 8140 requirements

Collaboration

DoD Secret clearance

C++

Python

JavaScript

Rust

Education

Bachelor’s degree

Tools

Coverity

Klocwork

SonarQube

Snyk

Sonatype

Anchore

JFrog Xray

AFL

AFL++

honggfuzz

strace

eBPF

Ghidra

IDA Pro

MITRE ATT&CK

Job description

SciTec Incorporated is seeking an Application Security Engineer Lead to secure mission-critical software for DoD programs. You will guide hands-on security analysis, embed security in development, and collaborate with software engineers to strengthen CI/CD pipelines.

The role requires 8+ years in cybersecurity or software development, DoD security clearance, and strong code-analysis skills. Join a fast-paced team delivering OPIR data processing for national defense, with comprehensive benefits.