Staff Application Security

The AES Group; United States; Remote; USD 143,000 - 214,000; Full time

Job summary

The AES Group is seeking a Staff Application Security Engineer to build and advance a scalable, developer-focused security program for a defense technology client. This remote, full-time role focuses on embedding security into SDLC and strengthening software supply-chain security.

You will lead threat modeling, secure design reviews, risk-based vulnerability management, and collaboration with DevOps to secure CI/CD pipelines while enabling rapid and secure software releases.

Qualifications

• 7+ years of experience in application security, product security, DevSecOps, secure software engineering, or a related cybersecurity field.
• Proven experience designing, implementing, or maturing an application security or secure SDLC program across multiple engineering teams.
• Hands-on experience with SAST, DAST, SCA, secrets scanning, and dependency vulnerability management.
• Experience integrating security controls into source control, CI/CD, build, release, and deployment workflows.
• Strong knowledge of secure coding, API security, authentication, authorization, injection vulnerabilities, insecure deserialization, and business-logic vulnerabilities.
• Experience with threat modeling, security architecture reviews, and risk-based vulnerability management.
• Knowledge of SBOMs, software provenance, artifact signing, build integrity, release attestations, and open-source software governance.
• Familiarity with NIST SP 800-218 (SSDF), OWASP SAMM, SLSA, or comparable frameworks.
• Ability to review production code and scripts in at least one modern programming language.
• Strong communication skills and the ability to explain technical risks to developers, leadership, auditors, and nontechnical stakeholders.

Responsibilities

• Establish and continuously improve secure SDLC policies, standards, procedures, and control requirements.
• Assess application security maturity across development teams, source-code repositories, CI/CD pipelines, build systems, and release processes.
• Implement and optimize SAST, DAST, SCA, secrets detection, infrastructure-as-code scanning, and container security tools.
• Partner with developers to identify, prioritize, remediate, and validate application security vulnerabilities.
• Lead threat modeling, secure design reviews, architecture assessments, and security requirements definition.
• Develop risk-based vulnerability management processes, remediation SLAs, exception handling, and risk acceptance procedures.
• Strengthen software supply-chain security through SBOMs, dependency verification, build provenance, artifact signing, and release attestations.
• Establish open-source governance practices covering dependency vulnerabilities, license compliance, component inventories, and approval workflows.
• Collaborate with DevOps and platform engineering to secure CI/CD pipelines, build environments, package registries, secrets, and deployment processes.
• Support vulnerability disclosure, CVE triage, security advisories, and product-security incident response.
• Develop a security champions program and provide secure-coding guidance, developer training, and security enablement.
• Create metrics and reports covering security risks, remediation performance, control coverage, SDLC adoption, and program maturity.
• Support customer assurance, audits, and regulatory compliance activities.

Skills

Application security

DevSecOps

Secure SDLC

Threat modeling

Code review

Security architecture

Communication

Tools

Snyk

Checkmarx

Veracode

GitHub Advanced Security

GitLab Security

Semgrep

SonarQube

OWASP ZAP

Burp Suite

Mend

Black Duck

Job description

Role: Staff Application Security Engineer

Location: Remote

Employment Type: Full-Time

Salary: $143,000 $214,000 per year

About The AES Group

The AES Group is a premier technology and engineering consulting company that has been bringing businesses and talent together for over 20 years to deliver innovative solutions that have the greatest positive impact on society. AES has helped over 40 business enterprises, including Fortune 500 companies, engage their customers, empower their employees, and transform their business operations with the power of cloud, data, AI, engineering, and other emerging technologies.

About The Role

One of our clients in the defense technology industry is seeking a Staff Application Security Engineer to build and advance a scalable, developer-focused application security program.

This role will establish company-wide Secure Software Development Lifecycle (SDLC) policies, integrate security controls into engineering workflows, and strengthen application and software supply-chain security. The successful candidate will combine hands‑on application security expertise with technical leadership to help engineering teams develop, test, build, and release secure software efficiently.

Key Responsibilities

• Establish and continuously improve secure SDLC policies, standards, procedures, and control requirements.
• Assess application security maturity across development teams, source-code repositories, CI/CD pipelines, build systems, and release processes.
• Implement and optimize SAST, DAST, SCA, secrets detection, infrastructure-as-code scanning, and container security tools.
• Partner with developers to identify, prioritize, remediate, and validate application security vulnerabilities.
• Lead threat modeling, secure design reviews, architecture assessments, and security requirements definition.
• Develop risk-based vulnerability management processes, remediation SLAs, exception handling, and risk acceptance procedures.
• Strengthen software supply-chain security through SBOMs, dependency verification, build provenance, artifact signing, and release attestations.
• Establish open-source governance practices covering dependency vulnerabilities, license compliance, component inventories, and approval workflows.
• Collaborate with DevOps and platform engineering to secure CI/CD pipelines, build environments, package registries, secrets, and deployment processes.
• Support vulnerability disclosure, CVE triage, security advisories, and product-security incident response.
• Develop a security champions program and provide secure-coding guidance, developer training, and security enablement.
• Create metrics and reports covering security risks, remediation performance, control coverage, SDLC adoption, and program maturity.
• Support customer assurance, audits, and regulatory compliance activities.

Required Qualifications

• 7+ years of experience in application security, product security, DevSecOps, secure software engineering, or a related cybersecurity field.
• Proven experience designing, implementing, or maturing an application security or secure SDLC program across multiple engineering teams.
• Hands‑on experience with SAST, DAST, SCA, secrets scanning, and dependency vulnerability management.
• Experience integrating security controls into source control, CI/CD, build, release, and deployment workflows.
• Strong knowledge of secure coding, API security, authentication, authorization, injection vulnerabilities, insecure deserialization, and business‑logic vulnerabilities.
• Experience with threat modeling, security architecture reviews, and risk‑based vulnerability management.
• Knowledge of SBOMs, software provenance, artifact signing, build integrity, release attestations, and open‑source software governance.
• Familiarity with NIST SP 800-218 (SSDF), OWASP SAMM, SLSA, or comparable frameworks.
• Ability to review production code and scripts in at least one modern programming language.
• Strong communication skills and the ability to explain technical risks to developers, leadership, auditors, and nontechnical stakeholders.

Preferred Qualifications

• Experience implementing SLSA-aligned controls, signed attestations, hardened build systems, and release integrity practices.
• Familiarity with SPDX, CycloneDX, VEX, or CSAF.
• Experience securing cloud‑native applications, containers, Kubernetes, APIs, microservices, and infrastructure‑as‑code.
• Experience with tools such as Snyk, Checkmarx, Veracode, GitHub Advanced Security, GitLab Security, Semgrep, SonarQube, OWASP ZAP, Burp Suite, Mend, or Black Duck.
• Knowledge of NIST SP 800-171, NIST SP 800-53, CMMC, FedRAMP, ISO 27001, or SOC 2.
• Experience supporting defense, government, critical‑infrastructure, or other high‑assurance environments.
• Relevant certifications such as CSSLP, CISSP, OSWE, GIAC, or equivalent security credentials.