Application Security Engineer III

Application Security Engineer III supporting mission-critical space systems with application-level security controls and government compliance requirements.

Responsibilities

• Create security architecture documentation and operational security guides to support government authorization processes
• Drive a vulnerability management program with remediation SLAs by severity: 30/90/180 days
• Conduct security code reviews for Elixir, Python, C++, and JavaScript codebases
• Triage and manage security automations leveraging SAST tools (CodeQL, Semgrep), SCA (JFrog Xray), and DAST
• Partner with engineering teams to address security findings and strengthen secure coding practices
• Develop and deliver security training for software engineers and systems administrators
• Create and maintain incident response playbooks for application security events
• Evaluate and integrate third-party security solutions to improve overall security capabilities

Requirements

• 3+ years experience in application security, product security, or security engineering
• Hands-on experience implementing security controls for compliance frameworks including NIST 800-171, NIST 800-53, FedRAMP, or CMMC
• Strong software engineering skills with the ability to write production-quality code in at least one language: Python, Rust, Elixir, C++, or similar
• Cloud security experience (Azure preferred; AWS or GCP acceptable)
• Knowledge of secure architecture principles, including threat modeling and risk assessment
• Knowledge of secure architecture patterns: Authentication and authorization using OAuth2, JWT, RBAC, ABAC
• Knowledge of cryptography and key management
• Understanding of defense-in-depth and Zero Trust
• Proven ability to collaborate with engineering teams to implement security controls without blocking velocity
• Eligible for DoD Secret or TS/SCI clearance

Preferred Skills

• Active TS/SCI clearance or ability to obtain and maintain a security clearance
• Direct experience with NIST 800-171 Rev 3 or NIST 800-53 implementation work (gap analysis, control implementation, evidence collection)
• Experience with DoD Impact Levels (IL2/IL4/IL5/IL6) or STIGs (Secure Technical Implementation Guides)
• Familiarity with Elixir/Erlang/Phoenix or other functional programming ecosystems (Scala, Haskell, F#, OCaml)
• Experience with Azure Government Cloud or other FedRAMP-authorized cloud environments
• Experience using Ghommit tool
• DevSecOps or Platform Security Engineering background, including GitOps workflows and CI/CD security
• DevSecOps or Platform Security Engineering background, including Infrastructure as Code security (Terraform, Bicep, Pulumi)
• DevSecOps or Platform Security Engineering background, including Kubernetes security (Pod Security Standards, network policies, service mesh)
• Experience with security incident response including detection engineering and SOAR integration
• Familiarity with aerospace, defense, or other highly regulated industries (finance, healthcare, critical infrastructure)
• Prior experience in startups or fast-paced environments, including building processes from scratch

Technologies

• Elixir, Python, C++, JavaScript
• CodeQL, Semgrep, JFrog Xray (SAST, SCA, DAST)
• OAuth2, JWT, RBAC, ABAC
• Azure, AWS, GCP
• NIST 800-171, NIST 800-53, FedRAMP, CMMC
• Zero Trust, Cryptography, Threat modeling

Compensation

• Base salary: USD 140,000 - 195,000 per year (Denver)
• Base salary note: Long Beach - USD 145,000 - 205,000 per year
• Equity and benefits included as part of total compensation
• Actual level and base salary determined case-by-case based on job-related knowledge and skills, education, location, and experience

Benefits

• 100% company-paid medical, dental, and vision coverage for you and your dependents, with HSA/HRA options
• Flexible Time Off (FTO) for exempt employees; accrued PTO up to 25 days for non-exempt employees
• 12 paid holidays; Parental Leave; Sick Leave
• Daily catered lunch and unlimited snacks for in-office employees
• 401(k) retirement plan; fitness reimbursement; Dog Fridays
• Equity participation as part of total compensation package

Location

• Denver, CO (onsite)
• Work location requirement: candidates must be located near Denver or Long Beach; significant work performed on site (#LI-Onsite)

Additional Notes

• Requires ability to obtain and maintain a security clearance
• Do not apply to fixed term and temporary roles
• Export regulations (ITAR): must be a U.S. citizen, lawful permanent resident, a protected individual as defined by 8 U.S.C. 1324b(a)(3), or eligible to obtain required authorizations from the U.S. Department of State
• Equal employment opportunity commitment; accommodations available upon request for disabilities or additional needs
• Third-party tools used to verify applicant identity and detect fraudulent applications