Software Secuirty Engineer - TS/SCI Clearance

CO1002 CDW Government, LLC; Washington (District of Columbia, VA); On-site; USD 190,000 - 230,000; Full time

Job summary

CDW is seeking a cleared Software Security Engineer to perform hands‑on code reviews, assess security against government standards, and translate requirements into actionable guidance for developers. You will validate SAST/DAST/SCA findings, evaluate dependencies, and support RMF/ATO activities.

You’ll collaborate with engineering teams to remediate vulnerabilities, participate in threat modeling, and integrate security checks into CI/CD pipelines, ensuring secure design and coding practices

Qualifications

• Active TS/SCI clearance.
• Hands-on secure code review or application security experience.
• Proficiency in programming languages such as Java, C#, Python, JavaScript/TypeScript, C/C++, or Go.
• Knowledge of government security requirements and NIST SP 800-53 controls.
• Ability to translate security requirements into concrete code changes and validation steps.
• Experience with Git-based version control and CI/CD workflows.
• Understanding of web application and API security, data protection in transit and at rest.
• Bachelor's degree or equivalent practical experience.

Responsibilities

• Perform manual security reviews of source code, pull requests, and application changes to identify vulnerabilities.
• Assess application security against NIST 800-53 and SP 800-218 practices and other requirements.
• Translate controls into code review checklists, testable criteria, and developer guidance.
• Review authentication, authorization, input validation, session management, and data protection for secure design.
• Execute SAST, DAST, SCA, and secrets scanning; validate findings and filter false positives.
• Evaluate third-party dependencies for vulnerabilities and SBOM activities.
• Collaborate with developers to propose fixes and verify remediation through retesting.
• Participate in threat modeling and architecture reviews to identify risks early.
• Integrate automated security checks into CI/CD workflows and gates.
• Document findings with locations, impact, and remediation evidence.
• Support RMF/ATO activities by providing security evidence to stakeholders.
• Communicate unresolved risks and release-readiness recommendations.

Skills

Security code review

Programming languages

Git workflows

Threat modeling

Education

Bachelor's degree in CS/SE/Cybersecurity

Experience with government programs

Tools

Fortify

Checkmarx

CodeQL

Veracode

SonarQube

Snyk

OWASP ZAP

Job description

Position Overview

We are seeking a cleared Software Security Engineer with a strong software engineering background and practical knowledge of U.S. government cybersecurity requirements. This hands‑on role will review source code, application designs, and software security testing results to assess whether applications meet applicable government security criteria. The engineer will translate security requirements into actionable development guidance, work directly with developers to remediate vulnerabilities, and document evidence supporting security assessments and release decisions. This position emphasizes application security and code‑level analysis rather than primarily policy administration or network security operations.

Key Responsibilities

• Perform manual security reviews of source code, pull requests, and application changes to identify vulnerabilities, insecure coding patterns, and deviations from approved security requirements.
• Assess application security against the program’s approved security baseline, including applicable NIST SP 800-53 controls, NIST Secure Software Development Framework (SP 800-218) practices, agency‑specific requirements, and DISA Application Security and Development STIG requirements where required by the customer.
• Translate applicable controls and security requirements into code review checklists, testable acceptance criteria, and developer implementation guidance.
• Review authentication, authorization, input validation, session management, error handling, audit logging, secrets management, data protection, and cryptographic implementation for secure design and coding practices.
• Execute and interpret static application security testing (SAST), dynamic application security testing (DAST), software composition analysis (SCA), and secrets scanning; validate findings and distinguish actionable vulnerabilities from false positives.
• Evaluate third‑party and open‑source dependencies for known vulnerabilities and support software component inventory and software bill of materials (SBOM) activities.
• Partner with developers to recommend practical code‑level fixes, review remediation changes, and verify closure through retesting and regression testing.
• Participate in threat modeling and application architecture reviews to identify security risks early in the software development life cycle.
• Integrate automated security checks and defined security gates into continuous integration and continuous delivery (CI/CD) workflows.
• Document findings with affected code locations, technical impact, applicable requirements, remediation recommendations, and verification evidence.
• Support Risk Management Framework (RMF) assessments and authorization to operate (ATO) activities by providing application security evidence and remediation status to security and compliance stakeholders.
• Communicate unresolved risks and release‑readiness recommendations to designated decision‑makers; escalated exceptions through the approved risk acceptance process.
• Help maintain secure coding standards and provide developers with practical guidance to prevent recurring vulnerabilities.

Required Qualifications

• Active TS/SCI Clearance
• Professional software engineering experience developing, testing, debugging, and maintaining production applications, with demonstrated hands‑on secure code review or application security experience.
• Proficiency in one or more programming languages relevant to the application environment, such as Java, C#, Python, JavaScript/TypeScript, C/C++, or Go, and the ability to understand unfamiliar codebases.
• Working knowledge of government security requirements and the ability to apply relevant NIST SP 800-53 controls and NIST SSDF practices to software development and verification.
• Ability to interpret customer‑specific security requirements and, where applicable, DISA STIG checks and translate them into concrete code changes and validation steps.
• Strong understanding of common application vulnerabilities, including injection, broken access control, insecure authentication, insecure deserialization, and sensitive data exposure.
• Experience using application security testing tools, validating results through code analysis, and explaining remediation options to developers.
• Experience with Git‑based version control, peer code review, automated testing, and CI/CD workflows.
• Understanding of web application and API security, least privilege, secure handling of credentials, and protection of data in transit and at rest.
• Ability to produce clear technical findings and maintain traceability between security requirements, implementation, testing, and remediation evidence.
• Bachelor’s degree in Computer Science, Software Engineering, Cybersecurity, or a related discipline, or equivalent practical experience.
• Experience supporting federal civilian or defense software programs, including application security reviews within RMF or ATO processes.
• Hands‑on experience applying the DISA Application Security and Development STIG and preparing supporting assessment evidence.
• Experience with tools such as Fortify, Checkmarx, CodeQL, Veracode, SonarQube, Snyk, OWASP ZAP, or comparable application security platforms.
• Experience with cloud‑native applications, containers, infrastructure as code, and software supply chain security.
• Familiarity with OWASP Application Security Verification Standard (ASVS), OWASP Top 10, Common Weakness Enumeration (CWE), and risk‑based vulnerability prioritization.
• Relevant secure software development or application security certifications, such as CSSLP or an equivalent credential.

Pay range: 190,000 - $230,000 depending on experience and skill set

Benefits overview: https://cdw.benefit-info.com/

Salary ranges may be subject to geographic differentials

CDW is committed to being an AI‑fluent organization We’re looking for people who bring curiosity, a learner’s mindset, and a willingness to engage with ever‑evolving technology and tools. We value adopting AI as a partner, openness to experimentation, and a shared interest in learning together on AI. Our goal is to create a culture where AI enhances—not replaces—human creativity and decision‑making. You don’t need to be an expert today; what matters is your readiness to explore, adapt, and grow with us as we integrate AI responsibly and effectively into our work. Additionally, CDW is committed to fostering an equitable, transparent, and respectful hiring process for all applicants. During our application process, our goal is to understand your experience, strengths, skills, and qualifications. As an AI forward company, we see AI not just as a tool, but as a catalyst for new ways of thinking, creating, and communicating. We encourage candidates to embrace an AI mindset, one that’s curious, adaptive, and ready to explore what’s possible. We welcome thoughtful use of AI to expand your perspective and elevate how you share your story, while ensuring your application remains rooted in your own background, judgment, and voice.

About Us

CDW is a Fortune 500 technology solutions provider that helps businesses, government, education, and healthcare organizations achieve what’s possible through technology. What makes CDW different isn’t just what we do—it’s how we do it. At CDW we act as one—building trust, speaking candidly, and working together to achieve more. We play to win—focusing on what matters most and delivering for our customers. And we think forward—staying curious, moving fast, and continuously learning. We believe meaningful work happens when people feel supported, heard, and empowered to contribute. That’s why we think of ourselves as coworkers, not just employees—working together to solve complex challenges and deliver real impact for our customers and communities. As a full‑stack, full‑lifecycle technology partner, CDW brings deep expertise, strong relationships, and broad industry knowledge to help turn ideas into outcomes. When you join CDW, you become part of a collaborative environment where your work matters, your growth is supported, and your contributions help shape what’s next. Together, we deliver the full promise of what technology can do. Together, we Make Amazing Happen.

CDW is an equal opportunity employer. All qualified applicants will receive consideration for employment without regards to race, color, religion, sex, sexual orientation, gender identity, national origin, disability status, protected veteran status or any other basis prohibited by state and local law.

At CDW, we make technology work so people can do great things. We are a leading multi‑brand technology solutions provider to business, government, education and healthcare customers in the United States, the United Kingdom and Canada. Our coworkers across the globe are working together to bring technology to life for our customers by solving complicated IT business challenges, providing outstanding service, and orchestrating the technology landscape to optimize our customers’ performance.