Senior AppSec Tooling Engineer — Regulated SDLC Automation

Cybersecurity Jobs; Monterey (CA); On-site; USD 120,000 - 180,000; Full time

Job summary

Cybersecurity Jobs in Monterey, CA seeks an AppSec tooling engineer to build and optimize a regulated, end-to-end application security scanning ecosystem across the SDLC.

You'll deploy, manage, and harden Sonatype, Fortify, StackRox, and Burp in on-prem and accredited cloud environments, integrate scans into CI/CD, and drive secure-by-default workflows.

Active Secret clearance required; 5+ years in regulated environments; onsite in Monterey, CA.

Qualifications

• Active Secret clearance required.
• 5+ years in application security engineering and/or DevSecOps in regulated environments.
• Hands-on administration and pipeline integration with Sonatype, Fortify, StackRox, and Burp Suite.
• Strong CI/CD and automation skills for repeatable integrations and policy gates.
• Secure SDLC, OWASP Top 10, dependency risk, and SBOM concepts; container/Kubernetes security.
• Linux administration, networking fundamentals, TLS/cert management, and SSO/LDAP.
• Java, Maven/Gradle; .NET/NuGet; Node/npm; Python/pip.
• Oracle Cloud Infrastructure familiarity.
• DoD/IC experience with RMF, STIGs, and vulnerability management processes.

Responsibilities

• Design, operate, and continuously improve the AppSec scanning ecosystem across the SDLC.
• Deploy, configure, harden, and maintain Sonatype, Fortify, StackRox, and Burp in on-prem and accredited cloud environments.
• Manage upgrades, plugins, licensing, capacity planning, backup/restore, HA, and DR.
• Establish SLAs/SLOs, monitoring/alerting, and operational runbooks.
• Integrate scanning into CI/CD pipelines (Jenkins, GitLab CI) with policy-based gating.
• Standardize secure-by-default workflows, including PR checks, nightly scans, and release criteria.
• Create reusable templates and reference implementations for product teams.
• Define scanning policies: severity thresholds, exploitability context, allowlists/denylists, quality gates.

Skills

AppSec engineering

DevSecOps

CI/CD automation

Jenkins

GitLab CI

Security tooling

SBOM

Active Secret clearance

DoD/IC experience

Tools

Sonatype Nexus IQ

Fortify

StackRox

Burp Suite

Jenkins

GitLab CI

Jira

Job description

Cybersecurity Jobs in Monterey, CA seeks an AppSec tooling engineer to build and optimize a regulated, end-to-end application security scanning ecosystem across the SDLC.

You'll deploy, manage, and harden Sonatype, Fortify, StackRox, and Burp in on-prem and accredited cloud environments, integrate scans into CI/CD, and drive secure-by-default workflows.

Active Secret clearance required; 5+ years in regulated environments; onsite in Monterey, CA.