Application Security Tooling Engineer

Monterey-based AppSec tooling engineer role focused on building and improving a regulated, end-to-end application security scanning ecosystem across the SDLC.

Responsibilities

• Design, operate, and continuously improve the defense agency’s application security (AppSec) scanning ecosystem across the SDLC.
• Run and integrate SCA with Sonatype, SAST with Fortify, container/Kubernetes security with StackRox (Red Hat Advanced Cluster Security), and DAST with Burp Suite in regulated environments.
• Deploy, configure, harden, and maintain Sonatype, Fortify, StackRox, and Burp across on-prem and/or accredited cloud environments.
• Manage upgrades, plugins, licensing, capacity planning, backup/restore, high availability, and disaster recovery.
• Establish SLAs/SLOs, monitoring/alerting, and operational runbooks.
• Integrate scanning into CI/CD pipelines (e.g., Jenkins, GitLab CI) using policy-based gating and risk-based exceptions.
• Standardize developer “secure-by-default” workflows, including pull request checks, nightly scans, and release readiness criteria.
• Create reusable templates and reference implementations for product teams.
• Define and tune scanning policies: severity thresholds, exploitability context, allowlists/denylists, and quality gates aligned to agency standards.
• Reduce false positives/negatives through rule tuning, calibration, and developer feedback loops.
• Maintain an auditable vulnerability management workflow covering triage, ownership, remediation SLAs, and exception/waiver documentation.
• Provide actionable findings with reproduction steps and secure coding guidance.
• Partner with engineering to remediate issues across code, dependencies, container images, and Kubernetes configurations.
• Coordinate retesting and verify fixes, including targeted Burp validation for high-risk apps/APIs.
• Implement image scanning, runtime detections, admission controls, and Kubernetes policy enforcement.
• Integrate with registries and orchestration platforms; maintain cluster baselines and least-privilege controls.
• Operationalize incident-ready detections and response playbooks with SOC/IR teams.
• Produce metrics and dashboards for vulnerability trends, time-to-remediate, pipeline pass rates, and policy exceptions.
• Support Risk Management Framework (RMF) / Authority to Operate (ATO) evidence needs using scan outputs, control mappings, and procedures.
• Experience supporting Agile project management; hands-on Jira experience strongly preferred.
• Manage a team of at least one other AppSec professional.

Requirements

• Active Secret clearance required.
• 5+ years in application security engineering and/or DevSecOps in regulated environments.
• Hands-on administration and pipeline integration experience with Sonatype (Nexus IQ/Lifecycle), Fortify (SCA/SSC), StackRox/Red Hat ACS, and Burp Suite (Professional/Enterprise preferred).
• Strong CI/CD and automation skills for repeatable integrations and policy gates.
• Working knowledge of Secure SDLC, OWASP Top 10, dependency risk, and SBOM concepts, plus container/Kubernetes security.
• Working knowledge of Linux administration, networking fundamentals, TLS/cert management, and identity integration (SSO/LDAP).
• Working knowledge of common languages/build systems: Java/Maven/Gradle, .NET/NuGet, Node/npm, Python/pip.
• Working knowledge of Oracle Cloud Infrastructure.
• DoD/IC experience with RMF, STIGs, and vulnerability management processes.

Technologies

• Sonatype (Nexus IQ/Lifecycle)
• Fortify (SCA/SSC)
• StackRox (Red Hat Advanced Cluster Security / Red Hat ACS)
• Burp Suite (Professional/Enterprise)
• Oracle Cloud Infrastructure
• Jenkins, GitLab CI, Jira
• OWASP Top 10, SBOM concepts
• Linux, TLS, SSO, LDAP
• Java, Maven, Gradle, .NET, NuGet, Node, npm, Python, pip
• Harbor, Artifactory, ECR
• Kubernetes, OpenShift, Helm
• Splunk, ServiceNow, SIEM, SOAR
• RMF, ATO, STIGs

Preferred Qualifications

• Familiarity with registries and orchestration: Harbor/Artifactory/ECR, Kubernetes/OpenShift, Helm.
• Experience integrating with SIEM/SOAR and ticketing (e.g., Splunk, ServiceNow, Jira).
• Relevant certifications (one or more): Security+, CISSP, CSSLP, GIAC, Kubernetes security certs.

Location: Monterey, CA (onsite)

Minimum experience: 5+ years