Application Security Engineer – Software Vulnerability Remediation

CONCEPT SOLUTIONS LLC is supporting a mission-critical application modernization program for a Department of War customer, and this Application Security Engineer role focuses on software vulnerability remediation in production environments. You will help locate security issues across an application portfolio, drive fixes in partnership with development teams, and keep security documentation aligned to continuous monitoring needs.

What you’ll do

• Identify and remediate security findings across existing production applications, including dependency vulnerabilities, container vulnerabilities, STIG compliance issues, and code-level findings from security scans and assessments.
• Maintain accurate and current Plans of Action and Milestones (POA&Ms) for the application portfolio, tracking security findings and remediation progress.
• Collaborate with the Information System Security Engineer (ISSE) to develop and maintain application security evidence for continuous monitoring requirements.
• Work with software development squads to implement secure coding fixes and address vulnerabilities in application codebases.
• Support ongoing application security improvements while ensuring continued operation and sustainment of production applications.

What you bring

• 4+ years of experience in application security, secure software engineering, or a closely related discipline.
• Hands-on experience identifying and remediating security vulnerabilities in Java or Go (Golang) applications.
• Experience addressing security findings within production software environments.

Tools and technologies

• Java
• Go (Golang)
• Syft
• Grype

Security and compliance focus

• Maintain or support application security evidence aligned to continuous monitoring.
• Support and address STIG compliance issues as part of remediation work.

Nice to have

• Experience using software vulnerability scanning tools such as Syft, Grype, or similar technologies.
• Familiarity with Security Technical Implementation Guides (STIGs).
• Active Secret security clearance.

Location, schedule, and logistics

• Location: Hybrid. Reston, VA headquarters and approved remote locations within the United States, with on-site work at Government facilities in Northern Virginia and Maryland as required.
• Equipment: Government-furnished equipment is used for access to Government environments.
• Schedule: Full-time, 40 hours per week, Monday through Friday, with core hours of 9:00 a.m. to 3:00 p.m. Eastern.
• Delivery cadence: Work is organized into two-week sprints, with a customer demonstration each sprint.
• Travel: 0–10% within the Washington, DC metropolitan area.

Clearance and eligibility

• U.S. citizenship required. Must be eligible to obtain and maintain a DoW security clearance.
• An active Secret clearance or higher is strongly preferred and may allow an earlier start.

Compensation and benefits

• Base salary: $130,000–$150,000 annually, depending on experience.
• Health insurance: Health, dental, and vision insurance.
• Life insurance: Life insurance.
• Retirement: Comprehensive 401(k) plan with matching and immediate vesting.

This position is contingent upon contract award, with an anticipated start in October 2026.