Application Security Engineer

Battelle is seeking an Application Security Engineer to support DHS RD&I efforts through Independent Verification and Validation (IV&V) of mission critical software applications. The role includes assessing application software and firmware for weaknesses, performing security testing, and documenting findings for technical teams and senior leadership.

Responsibilities

• Evaluate and analyze application software and firmware source code and binaries for exploitable weaknesses
• Use application security testing tools to identify potential vulnerabilities
• Conduct Static Application Security Testing (SAST) on source code repositories and executable binaries
• Research exploitation methods and develop exploits for identified vulnerabilities
• Provide vulnerability remediation recommendations, including updates, source code corrections, or other mitigations
• Write in-depth software security reports summarizing findings and describing risks
• Present findings to software development teams
• Brief assessment results to senior leadership and executives
• Reverse engineer application software and firmware binaries when required under the guidance of the Senior Application Security Engineer
• Evaluate and analyze leading edge security technologies to improve the organization’s security posture
• Work with research and development (R&D) organizations to define requirements for leading-edge security solutions
• Collaborate with Cyber Security Practice Team Members locally and across the Cyber Security Practice for full-lifecycle delivery of security technology solutions
• Contribute to Battelle Cyber process improvement initiatives
• Participate in leading edge cyber security conferences, working groups, and training

Required Qualifications

• Active DoD SECRET Clearance or DHS “Enter on Duty” (EOD) or “Full Suitability Approval” (FSA) Background Investigation status; US Citizenship required
• 5+ years of software engineering experience with compiled and interpretive programming languages
• 4+ years of experience in information assurance and/or cybersecurity
• Bachelors Degree (BS/BA)
• Experience with decompiling and reverse engineering tools such as Ghidra and JDecompiler
• Experience with SAST tools such as Black Duck Coverity
• Experience with software composition analysis tools such as Anchore Syft
• Familiarity with Software Bills of Materials (SBOMs)
• Experience with virtual machines
• Experience with common Linux distributions such as Ubuntu and Red Hat
• Experience programming in Java, C/C++, C#/.NET, Python, and JavaScript
• Proven experience in collaborative sessions with strong verbal and written communication skills and tactful negotiation skills
• Certified Information Systems Professional (CISSP)

Preferred Qualifications

• Current DHS Security Suitability
• M.S. in Information Systems or related field
• Certified Secure Software Lifecycle Professional (CSSLP)
• Experience with Ruby, Rust, Go, TypeScript, and PHP
• Experience with Continuous Integration / Continuous Development (CI/CD) pipelines
• Penetration Testing experience and/or certifications
• Experience with C-UAS, Sea (Maritime), Air, and/or Border operations and DHS systems
• Experience with IT Security Engineering in support of systems development, interface, and/or architecture requirements and concepts
• Familiarity with MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK) Framework
• Familiarity with NIST SP 800-53 Rev. 5
• Familiarity with DHS 4300A
• Experience with cloud application security
• Experience with cloud environment operations
• Consulting environment experience
• Military veteran with relevant Application Security, IT and computer security experience will be considered a plus

Technologies

• Ghidra
• JDecompiler
• Black Duck Coverity
• Anchore Syft
• Software Bills of Materials (SBOMs)
• Java
• C/C++
• C#/.NET
• Python
• JavaScript
• Linux
• Ubuntu
• Red Hat
• Virtual machines

Location and Work Arrangement

Crystal City, VA (hybrid). The role follows a hybrid schedule with 60% in-office and 40% remote, with Monday and Tuesday as common in-office days.

Benefits

• Compressed work schedule with most team members following a flexible compressed schedule allowing every other Friday off
• Enhanced work flexibility through hybrid arrangement (60% in-office and 40% remote, with Monday and Tuesday as common in-office days)
• Paid time off
• Medical, dental, and vision coverage with wellness incentives and benefits plus optional supplemental benefits
• Partner coverage, gender-affirming care and health support, and family formation support
• 401(k) retirement savings plan with an industry-leading contribution approach for most employees, plus match on top of contributions
• Tuition assistance

Compensation

The salary range for this role is $130,000 to $190,000 per year, in addition to a comprehensive benefits package. Salary is determined based on factors including education, relevant experience, skills, and certifications. Ranges may vary based on geographic location and market conditions.