Cybersecurity Engineer – Application/Software Security

Data Systems Analysts, Inc. (DSA) is hiring a TS/SCI-cleared Cybersecurity Engineer focused on application and software security in a secure DoD environment at NGIC.

Responsibilities

• Own software security within the cyber engineering team by providing technical guidance to secure applications, APIs, and back-end services.
• Conduct security testing of applications and validate that fixes address identified findings.
• Perform source code reviews against secure coding standards to identify vulnerabilities, insecure design, and exploitable weaknesses.
• Implement, tune, and maintain software security tooling such as SAST, DAST, dependency scanning, and container scanning, and integrate tooling into development and release processes.
• Evaluate open-source and commercial cyber tools and source code to determine security risk, fit, and what can be adapted for mission requirements.
• Partner with engineers, system admins, architects, ISSOs, and ISSMs to define security requirements and verify tools and controls are sufficient.
• Assess risk tied to major software changes, unpatched components, and software reaching end of support.
• Apply adversary techniques (for example, MITRE ATT&CK) and perform threat modeling to prioritize findings based on real-world impact.
• Document independent test results, release risk, and technical evidence supporting RMF and ATO activities.
• Communicate software risks, findings, and practical fixes to technical teams, system owners, and leadership.

Requirements

• BS degree in Computer Science, Software Engineering, Computer Information Systems, Cybersecurity, or related field.
• Experience may be substituted for degree.
• TS/SCI clearance.
• CompTIA Security+ (DoD 8140 compliant).
• Minimum 5 years combined experience in software development, application security, penetration testing, or secure software assessment.
• Hands-on software development experience in at least one language: Python, Java, C#, Go, or JavaScript, with understanding of back-end services, APIs, and databases.
• Demonstrated ability to find and validate software vulnerabilities via code review, security testing, or technical assessment.
• Working knowledge of OWASP Top 10 and CWE, including exploitation and remediation approaches.
• Ability to assess exploitability and impact and communicate clear, practical fixes to engineers and compliance staff.
• Ability to work independently as the primary software security resource on a cybersecurity team.

Technologies

• Microsoft Copilot
• Languages: Python, Java, C#, Go, JavaScript
• Security testing and scanning: SAST, DAST, dependency scanning, container scanning
• Standards and frameworks: MITRE ATT&CK, OWASP Top 10, CWE
• Tools: Fortify, SonarQube, Checkmarx, Burp Suite, OWASP ZAP
• Databases and querying: SQL, Oracle, PostgreSQL
• DevOps: GitLab, Jenkins, CI/CD pipelines
• Cloud: AWS/GovCloud
• Supply chain and compliance: SBOMs, RMF, NIST SP 800-53, eMASS, DISA Application Security and Development STIG, ATO

Preferred Experience / Qualifications

• Certifications such as GWAPT, OSCP, OSWE, CSSLP, PenTest+, CySA+, SecurityX/CASP+, CEH, CISSP, or other relevant certifications.
• Experience with SAST/DAST tools including Fortify, SonarQube, Checkmarx, Burp Suite, or OWASP ZAP.
• Penetration testing, red team, or web application testing experience.
• Experience integrating security checks into CI/CD pipelines (GitLab, Jenkins).
• Experience with SQL, relational databases (Oracle, PostgreSQL), and ETL workflows.
• Familiarity with containers, AWS/GovCloud, software supply chain security, or SBOMs.
• Familiarity with RMF, NIST SP 800-53, eMASS, and the DISA Application Security and Development STIG.
• Experience supporting DoD, U.S. Army, or Intelligence Community missions.

Job Details

• Location: Alexandria, VA (onsite)
• Clearance: TS/SCI
• Estimated Salary: USD 140,000 - 170,000 per year
• Education: BS degree in a relevant field

Role summary: Secure mission-critical software in a secure DoD environment at NGIC by owning application security testing, code review, vulnerability validation, and maintaining security tooling integrated into development and release processes.