Senior Security Engineer - Secure SDLC, WAF & Cloud

Socket.dev; Reston (VA); On-site; USD 140,000 - 202,000; Full time

Job summary

Federal Home Loan Banks Office of Finance is seeking a Senior Security Engineer to design, implement, operate, and continually improve security controls across applications and platforms. Focused on application security, embedding security into the SDLC and CI/CD pipelines, and strengthening web/API protections.

The role partners closely with development, DevOps, and operations teams to build secure-by-default applications and services, while contributing to broader security engineering

Qualifications

• Minimum 6 to 8 years of experience in Application Security, designing, implementing, and operating security controls.
• Hands-on experience with web application security and OWASP Top 10 vulnerabilities.
• Experience with WAF/API security, container security, and security testing.
• Ability to investigate problems within established methodologies and best practices.

Responsibilities

• Develop and maintain software application security policies and procedures.
• Implement security controls for applications and supporting platforms.
• Collaborate with DevOps to build a secure CI/CD pipeline.
• Design and operate web application firewall and API protections; tune rules and automate policy updates.
• Identify vulnerabilities, perform risk assessments, and provide mitigations.
• Develop security monitoring for the application stack and investigate incidents.

Skills

Application security

WAF & API security

OWASP Top 10

CI/CD security

Security incident investigation

Education

Bachelor’s Degree in Information Security or Computer Science or Computer/Electrical Engineering

Tools

WAF tooling

Vulnerability scanners

Container security tooling

Job description

Federal Home Loan Banks Office of Finance is seeking a Senior Security Engineer to design, implement, operate, and continually improve security controls across applications and platforms. Focused on application security, embedding security into the SDLC and CI/CD pipelines, and strengthening web/API protections.

The role partners closely with development, DevOps, and operations teams to build secure-by-default applications and services, while contributing to broader security engineering