Application Security Engineer

Leidos is building agile software teams in Omaha, Nebraska, where security engineering is integrated into day-to-day development. As an Application Security Engineer, you will help adjudicate application and dependency risk using a defensible, risk-based approach, while strengthening software supply chain security across the lifecycle. This role is primarily onsite in Omaha, with some remote or work-from-home possibility.

Key Responsibilities

• Independently evaluate software dependencies by assessing risk, approving or rejecting components, and documenting defensible technical decisions.
• Improve software supply chain security using SBOMs, transitive dependency analysis, component provenance, vulnerability intelligence, and artifact integrity.
• Assess vulnerabilities based on real application use and operational context, rather than relying only on automated scan results or CVSS scores.
• Partner with software engineers and DevSecOps teams to resolve security findings while minimizing unnecessary impact to development velocity.
• Use tools and workflows including Jira, Confluence, Nexus, Git, development operations, collaboration, and source control.
• Support creation and updates of documentation and specifications for design, development, and testing.

Requirements

• US Citizenship with the ability to obtain and maintain a TS/SCI within 365 days of your start date with Leidos.
• Bachelor’s degree with 4+ years of experience, or Master’s degree with 2+ years of experience (additional experience may be considered in lieu of a degree).
• Experience performing application security assessments, vulnerability analysis, and security risk evaluations across enterprise software applications and development environments.
• Experience adjudicating third-party software libraries, open-source components, and external dependencies for security vulnerabilities, licensing concerns, and software supply chain risks.
• Working knowledge of SCA, SAST, and DAST methodologies and tools.
• Experience analyzing CVEs, CVSS, and vulnerability intelligence to determine applicability, exploitability, and operational risk.
• Understanding of secure software development lifecycle practices (SSDLC), secure coding principles, and application security best practices.
• Familiarity with software supply chain security concepts including dependency management, SBOMs, artifact integrity, and vulnerability remediation.
• Experience collaborating with development teams to identify, prioritize, document, and remediate application security findings.
• Working knowledge of common application security risks and vulnerabilities, including OWASP Top 10 and CWE classifications.
• Ability to produce technical security assessments, document risk-based adjudication decisions, and communicate findings and recommendations to technical and program stakeholders.

Technologies

• JavaScript, Jira, Confluence, Nexus, Git
• SBOMs, Software Composition Analysis (SCA), Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST)
• CVEs, CVSS
• OWASP Top 10, CWE classifications
• SSDLC

Compensation

Pay range: USD 87,100 - 157,450 per year.

Preferred Qualifications

• US Citizen with an active TS/SCI security clearance.
• Experience supporting application security activities within DoD, Intelligence Community, or other highly regulated, security-sensitive software development environments.
• Experience with modern software development (Java, Python, Javascript, Rust, etc.).
• Experience implementing or managing third-party library approval and adjudication processes, including evaluation of component provenance, known vulnerabilities, transitive dependencies, licensing restrictions, and mitigation strategies.
• Hands-on experience with SCA and vulnerability management tools such as Sonatype Nexus IQ, JFrog Xray, Black Duck, Snyk, Mend, Dependency-Track, or equivalent.
• Experience with application security testing tools such as Fortify, Checkmarx, Veracode, Semgrep, SonarQube, or equivalent technologies.
• Experience generating, analyzing, and maintaining SBOMs using formats such as CycloneDX and SPDX.
• Familiarity with software supply chain security guidance including NIST SP 800-218 (SSDF), NIST SP 800-53, NIST SP 800-161, and relevant CISA guidance.
• Experience assessing vulnerability exploitability and prioritizing remediation using VEX, CISA KEV, EPSS, and other threat intelligence sources.
• Experience integrating automated security scanning, dependency analysis, and compliance checks into CI/CD pipelines and DevSecOps workflows.
• Experience securing containerized applications, container images, and Kubernetes-based deployment environments.
• Understanding artifact repositories, package managers, and dependency ecosystems including Maven, Gradle, npm, NuGet, PyPI, and Cargo.
• Experience evaluating component provenance, artifact signing, integrity verification, and build-pipeline security using technologies such as Sigstore, SLSA, or equivalent approaches.
• Ability to evaluate vulnerability findings in context of application architecture, runtime behavior, and operational exposure.
• Experience developing security policies, risk acceptance criteria, vulnerability exception processes, and documented mitigation strategies.
• Experience with RMF, ATO processes, and security control assessment activities.
• Experience scripting or automating security analysis workflows using Python, PowerShell, Bash, or similar technologies.
• Familiarity with secure development practices for Java, C/C++, Rust, JavaScript, or other enterprise languages.
• Relevant industry cybersecurity certifications such as CISSP, CSSLP, Security+, or GIAC GWEB.
• Experience with USSTRATCOM Nuclear Planning process.