Web App Security Engineer — DevSecOps for Federal

Essnova Solutions, Inc.; Washington; Hybrid; USD 120,000 - 160,000; Full time

Job summary

Essnova Solutions, Inc. in the Washington DC metropolitan area is seeking a Web Application Security Engineer to integrate security across the SDLC and protect enterprise web apps and APIs from evolving threats.

The ideal candidate has experience with AppSec, secure SDLC, vulnerability management, DevSecOps, and federal cybersecurity frameworks, and will collaborate with cross-functional teams to strengthen the organization’s security posture.

Qualifications

• Experience in AppSec or web security across SDLC.
• Secure coding practices and vulnerability remediation.
• Experience with OWASP Top 10 vulnerabilities.
• Familiarity with federal frameworks (NIST, FedRAMP).
• Experience integrating security into CI/CD pipelines.
• Ability to conduct threat modeling and security testing.
• Excellent analytical and communication skills.

Responsibilities

• Embed security throughout the SDLC.
• Perform web app vulnerability assessments and threat modeling.
• Identify and remediate vulnerabilities.
• Configure and maintain WAF and security controls.
• Integrate security tools into CI/CD and DevSecOps.
• Monitor logs and investigate security events.
• Collaborate with developers and cybersecurity teams.
• Support compliance with NIST, FedRAMP, FISMA.
• Develop security docs and remediation guidance.

Skills

AppSec

Secure SDLC

Vulnerability assessment

OWASP Top 10

WAF

CI/CD security

FedRAMP/NIST

DevSecOps

Tools

WAF

SAST

DAST

SCA

CI/CD tools

Job description

Essnova Solutions, Inc. in the Washington DC metropolitan area is seeking a Web Application Security Engineer to integrate security across the SDLC and protect enterprise web apps and APIs from evolving threats.

The ideal candidate has experience with AppSec, secure SDLC, vulnerability management, DevSecOps, and federal cybersecurity frameworks, and will collaborate with cross-functional teams to strengthen the organization’s security posture.