Senior Security Engineer 5503

Tier4 Group; Reston (VA); On-site; USD 120,000 - 160,000; Full time

Job summary

Tier4 Group in Reston, VA, seeks a Senior Security Engineer to design, implement, and operate security controls across applications and platforms. The role emphasizes embedding security into SDLC and CI/CD pipelines, strengthening web/API protections, and proactive detection, while collaborating with development, DevOps, and operations teams to build secure-by-default services.

You will lead policy development, implement controls, and tune WAF rules, conduct vulnerability assessments, and drive

Qualifications

• 6–8 years of enterprise application security experience.
• Hands-on with web app security and OWASP Top 10.
• Experience with WAF/API security, container security, and image scanning.
• Conduct web app security assessments or pen tests.
• Experience with OAuth/OpenID authentication services.
• Experience operating on-prem or cloud security platforms.
• Strong problem solving and cross-functional communication.

Responsibilities

• Develop and maintain application security policies and controls.
• Partner with DevOps to secure CI/CD pipelines.
• Design and operate WAF and API protections; tune rules and automate policy updates.
• Identify vulnerabilities, perform risk assessments, and provide mitigations.
• Develop security monitoring for the application stack.
• Lead technical investigations of security incidents.
• Engage with senior stakeholders to interpret risks and priorities.

Skills

Application Security

OWASP Top 10

WAF/API Security

Vulnerability Assessments

OAuth/OpenID

On-Prem/Cloud Security

Incident Investigations

CI/CD Security

Security Monitoring

Stakeholder Communication

Education

Bachelor's Degree in Information Security or Computer Science or Computer/Electrical Engineering

Tools

WAF

Vulnerability Scanners

CI/CD tooling

Cloud Security Platforms

Job description

The Senior Security Engineer designs, implements, operates, and continuously improves the security technologies and controls across applications and supporting platforms. Primary focus is Application Security -embedding security into the SDLC and CI/CD pipelines, strengthening web/API protections, and enabling proactive detection, while contributing broadly to Security Engineering capabilities (identity, cloud/onprem security platforms, logging/telemetry, and automation). The role partners closely with development, DevOps, and operations teams to build secure-by-default applications and services.

PRINCIPAL RESPONSIBILITIES

• Develop and maintain software application security policies and procedures
• Implement software application security controls
• Partner with DevOps in developing a secure CI/CD pipeline
• Design and operate web application firewall (WAF) and API protections; tune rules, reduce false positives, and automate policy updates
• Identify application security vulnerabilities and issues, perform risk assessments and provide mitigations
• Develop security monitoring for application stack
• Conduct technical investigations of application security incidents
• Interface with senior stakeholders across the IT leadership team to proactively interpret risks and priorities.
• Support the diversity and inclusion strategy by following policies and procedures that ensure opportunities for employees and diverse business partners.
• Assist with other job duties as assigned.

REQUIREMENTS

• A minimum 6 to 8 years of experience in Application Security (designing, implementing, and operating security controls in enterprise application environments).
• Hands-on experience with web application security, including OWASP Top 10 vulnerabilities
• Hands-on experience with WAF/API security (policy design, rule tuning, automation), container security (runtime hardening, image scanning, vulnerability risk assessments)
• Hands-on experience with conducting web application security scans, vulnerability assessments and/or penetration testing
• Experience in investigating problems and processes within established methodologies and best practices.
• Experience working with Authentication and Authorization services like OAuth and OpenID
• Experience in operating on-prem or cloud-based security platforms
• Ability to troubleshoot security and network-related issues and communicate technical findings effectively
• Ability to listen and integrate ideas from diverse groups of individuals, build and maintain respectful relationships, collaborate with others, and resolve conflicts constructively.
• Bachelor's Degree in Information Security or Computer Science or Computer/Electrical Engineering, and/or equivalent field experience.
• Proof of eligibility to work in the United States.