Software Secuirty Engineer - TS/SCI Clearance

CDW; Satellite Beach (FL); On-site; USD 110,000 - 160,000; Full time

Job summary

CDW seeks a cleared Software Security Engineer with a strong software engineering background to review code, designs, and testing results against government security criteria. You will translate security requirements into actionable guidance, work with developers to remediate vulnerabilities, and document evidence for security assessments.

You will perform manual and automated security testing, assess baselines, and support RMF/ATO processes, contributing to secure design and robust software

Qualifications

• Active TS/SCI clearance.
• Hands-on secure code review or application security experience.
• Proficiency in Java, C#, Python, JavaScript/TypeScript, C/C++, or Go.
• Knowledge of government security requirements and NIST SP 800-53.
• Ability to translate security requirements into concrete code changes.
• Experience with Git-based version control and peer code review.
• Understanding of web app and API security.
• Bachelor's degree or equivalent practical experience.
• Experience with RMF/ATO in federal programs.

Responsibilities

• Perform manual security reviews of source code, PRs, and changes for vulnerabilities.
• Assess security baselines including NIST SP 800-53 and SP 800-218 practices.
• Translate controls into code review checklists and guidance.
• Review authentication, authorization, input validation, and data protection for secure coding.
• Execute SAST, DAST, SCA, and secrets scanning and validate findings.
• Evaluate third party dependencies for known vulnerabilities and SBOM activities.
• Collaborate with developers to implement fixes and verify closures.
• Participate in threat modeling and architecture reviews.
• Integrate automated security checks into CI/CD pipelines.
• Document findings with locations, impact, and remediation evidence.
• Support RMF/ATO activities with security evidence.

Skills

Secure code review

CI/CD workflows

Git version control

Application security

Education

Bachelor's degree in Computer Science, Software Engineering, Cybersecurity, or equivalent

Tools

SAST tools

DAST tools

Software Composition Analysis (SCA)

Secrets scanning

SBOM management

Job description

Position Overview

We are seeking a cleared Software Security Engineer with a strong software engineering background and practical knowledge of U.S. government cybersecurity requirements. This hands-on role will review source code, application designs, and software security testing results to assess whether applications meet applicable government security criteria. The engineer will translate security requirements into actionable development guidance, work directly with developers to remediate vulnerabilities, and document evidence supporting security assessments and release decisions. This position emphasizes application security and code-level analysis rather than primarily policy administration or network security operations.

Key Responsibilities

• Perform manual security reviews of source code, pull requests, and application changes to identify vulnerabilities, insecure coding patterns, and deviations from approved security requirements.
• Assess application security against the program's approved security baseline, including applicable NIST SP 800-53 controls, NIST Secure Software Development Framework (SP 800-218) practices, agency-specific requirements, and DISA Application Security and Development STIG requirements where required by the customer.
• Translate applicable controls and security requirements into code review checklists, testable acceptance criteria, and developer implementation guidance.
• Review authentication, authorization, input validation, session management, error handling, audit logging, secrets management, data protection, and cryptographic implementation for secure design and coding practices.
i>Execute and interpret static application security testing (SAST), dynamic application security testing (DAST), software composition analysis (SCA), and secrets scanning; validate findings and distinguish actionable vulnerabilities from false positives.i>
• Evaluate third-party and open-source dependencies for known vulnerabilities and support software component inventory and software bill of materials (SBOM) activities.
• Partner with developers to recommend practical code-level fixes, review remediation changes, and verify closure through retesting and regression testing.
• Participate in threat modeling and application architecture reviews to identify security risks early in the software development life cycle.
• Integrate automated security checks and defined security gates into continuous integration and continuous delivery (CI/CD) workflows.
• Document findings with affected code locations, technical impact, applicable requirements, remediation recommendations, and verification evidence.
• Support Risk Management Framework (RMF) assessments and authorization to operate (ATO) activities by providing application security evidence and remediation status to security and compliance stakeholders.
• Communicate unresolved risks and release-readiness recommendations to designated decision-makers; escalation exceptions through the approved risk acceptance process.
• Help maintain secure coding standards and provide developers with practical guidance to prevent recurring vulnerabilities.

Required Qualifications

• Active TS/SCI Clearance
• Professional software engineering experience developing, testing, debugging, and maintaining production applications, with demonstrated hands‑on secure code review or application security experience.
• Proficiency in one or more programming languages relevant to the application environment, such as Java, C#, Python, JavaScript/TypeScript, C/C++, or Go, and the ability to understand unfamiliar codebases.
• Working knowledge of government security requirements and the ability to apply relevant NIST SP 800-53 controls and NIST SSDF practices to software development and verification.
• Ability to interpret customer-specific security requirements and, where applicable, DISA STIG checks and translate them into concrete code changes and validation steps.
• Strong understanding of common application vulnerabilities, including injection, broken access control, insecure authentication, insecure deserialization, and sensitive data exposure.
• Experience using application security testing tools, validating results through code analysis, and explaining remediation options to developers.
• Experience with Git-based version control, peer code review, automated testing, and CI/CD workflows.
• Understanding of web application and API security, least privilege, secure handling of credentials, and protection of data in transit and at rest.
• Ability to produce clear technical findings and maintain traceability between security requirements, implementation, testing, and remediation evidence.
• Bachelor's degree in Computer Science, Software Engineering, Cybersecurity, or a related discipline, or equivalent practical experience.
• Experience supporting federal civilian or defense software programs, including application security reviews within RMF or ATO processes.
• Hands‑on experi