Application Security Engineer

Accenture Federal Services is seeking a Senior Application Security Engineer in Washington, DC to lead an Application Security (AppSec) scrum team and work closely with development teams to embed security practices into the software delivery lifecycle. The role focuses on threat modeling, CI/CD pipeline security, vulnerability testing and remediation guidance, and secure AI application design in a federal environment.

Key Responsibilities

• Lead the AppSec scrum team and manage all agile ceremonies.
• Prioritize the security backlog and coach teammates on application security best practices.
• Drive collaboration across security, development, and operations to reduce risk across delivery.
• Use AI tools to improve team workflows and efficiency.
• Test, triage, and support remediation of security vulnerabilities affecting web and AI applications.
• Provide clear, actionable remediation guidance to engineering teams.
• Architect and maintain secure CI/CD pipelines using GitLab and Jenkins.
• Implement hardened build processes and secure supply chain practices, including SBOM management.
• Lead shift-left threat modeling and partner with engineers to address risks early.
• Ensure AI agents and pipelines follow secure design principles.
• Integrate security tools into developer workflows, including Snyk, Nexus, and JFrog.
• Manage dependency lifecycles and ensure artifacts are verified and signed.
• Balance security requirements with delivery velocity in a federal environment.
• Navigate technical and organizational gray areas effectively.

Required Qualifications

• 6+ years in software engineering and application or infrastructure security, with hands-on production coding experience.
• Proven experience securing CI/CD pipelines.
• Foundational understanding of one or more build systems such as Gradle, Maven, and Docker/Kubernetes.
• Experience with SBOM formats including CycloneDX and SPDX.
• Strong understanding of AppSec principles, SSDF, threat modeling, and secrets management.

Technology Focus

• CI/CD and tooling: GitLab, Jenkins
• Security and artifact systems: Snyk, Nexus, JFrog
• SBOM and related standards: SBOM, CycloneDX, SPDX
• Build and runtime: Gradle, Maven, Docker, Kubernetes
• Signing and verification: Sigstore, Cosign

Bonus Qualification

• Experience with artifact signing using Sigstore/Cosign.

Eligibility Requirements

• US Citizen
• Eligible to obtain a Public Trust clearance

Location and Compensation

• Location: Washington, DC (onsite)
• Compensation: USD 109,500 - 224,200 per year
• Minimum Experience: 6 years