Senior AppSec Lead: DevSecOps for Mission-Critical Software

SciTec; Boulder (CO); On-site; USD 155,000 - 185,000; Full time

Benefits offered by this job

401(k) match

Health insurance

Dental and Vision insurance

Life insurance

Paid time off

Job summary

SciTec, a defense contractor, seeks an Application Security Engineer Lead to secure mission-critical software handling OPIR sensor data in a DevSecOps environment in Boulder, CO.

You will perform security analysis (SAST, SCA, fuzzing), lead a security team, and collaborate with software engineers and government customers to embed secure design practices through CI/CD pipelines. A DoD Secret clearance and 8+ years in cybersecurity are preferred.

Qualifications

• Bachelor’s degree plus 8+ years of experience in cybersecurity or software development.
• 2+ years focused on application/security and analyzing source code for security flaws.
• Familiarity with secure software development practices.
• Strong analytical and problem-solving skills.
• Ability to qualify for and maintain a DoD Secret security clearance.
• Ability to meet DoD 8140.01 Cyberspace Workforce Management requirements within six months of hire.
• Ability to collaborate with government customers and engineers.

Responsibilities

• Perform application security analysis using SAST, SCA, fuzzing, and manual reviews.
• Lead an application security team in support of multiple programs.
• Identify, analyze, and remediate application vulnerabilities.
• Support engineers in integrating security into designs and CI/CD pipelines.
• Design, implement, and improve continuous integration security analysis tooling.
• Tune and maintain security tools to reduce false positives and improve signal quality.
• Assist development teams in communicating findings and fixes.
• Support threat modeling and secure design reviews.
• Stay current with vulnerabilities and mitigation strategies.
• Document findings and best practices.

Skills

Analytical thinking

Detail-oriented

Written and verbal communication

Programming languages: C++

Programming languages: Python

Programming languages: JavaScript

Programming languages: Rust

Collaboration in DevSecOps

Education

Bachelor’s degree in a related field

Tools

Coverity

Klocwork

SonarQube

Snyk

Sonatype

Anchore

JFrog Xray

AFL/AFL++

honggfuzz

strace

eBPF

Ghidra

IDA Pro

MITRE ATT&CK

Job description

SciTec, a defense contractor, seeks an Application Security Engineer Lead to secure mission-critical software handling OPIR sensor data in a DevSecOps environment in Boulder, CO.

You will perform security analysis (SAST, SCA, fuzzing), lead a security team, and collaborate with software engineers and government customers to embed secure design practices through CI/CD pipelines. A DoD Secret clearance and 8+ years in cybersecurity are preferred.