Cybersecurity Engineer – Application/Software Security

Data Systems Analysts, Inc. is seeking a TS/SCI-cleared Cybersecurity Engineer focused on application and software security for onsite work supporting mission-critical DoD systems. In this role at NGIC, you will help strengthen software security end to end, from secure development practices and vulnerability validation to evidence generation for RMF and ATO activities.

This position is located in Arlington, VA (onsite), with a salary range of USD 140,000 - 170,000 per yearly. The candidate should have 5 years of relevant experience and a BS degree in Computer Science, Software Engineering, Computer Information Systems, Cybersecurity, or a related field.

What you’ll do

• Own software security responsibilities within a cyber engineering team, providing technical guidance for securing applications, APIs, and back-end services.
• Conduct security testing of applications and validate that remediations resolve identified findings.
• Perform source code reviews aligned to secure coding standards to detect vulnerabilities, insecure design patterns, and exploitable weaknesses.
• Implement, tune, and maintain software security tooling including SAST, DAST, and dependency and container scanning, integrating results into development and release processes.
• Assess open-source and commercial cyber tools and code to determine fit, security risk, and what can be adapted to meet mission requirements.
• Collaborate with engineers, system administrators, architects, ISSOs, and ISSMs to define security requirements and confirm that tools and controls are sufficient.
• Evaluate risks introduced by major software changes, unpatched components, and software reaching end of support.
• Apply adversary techniques such as MITRE ATT&CK and threat modeling to prioritize findings based on real-world impact.
• Document independent test results, release risk, and technical evidence supporting RMF and ATO activities.
• Communicate software security risks, findings, and practical fixes to engineering teams, system owners, and leadership.

Qualifications

• BS degree in Computer Science, Software Engineering, Computer Information Systems, Cybersecurity, or a related field.
• TS/SCI Clearance.
• CompTIA Security+ (DoD 8140 compliant).
• Minimum 5 years of combined experience in software development, application security, penetration testing, or secure software assessment.
• Hands-on software development experience in at least one language such as Python, Java, C#, Go, or JavaScript, with familiarity across back-end services, APIs, and databases.
• Proven ability to find and validate software vulnerabilities through code review, security testing, or technical assessment.
• Working knowledge of OWASP Top 10 and CWE, including how weaknesses are exploited and how to remediate them.
• Ability to assess exploitability and impact, and clearly communicate practical fixes to engineers and compliance staff.
• Capability to work independently as the primary software security resource on a cybersecurity team.

Technologies you may work with

• Microsoft Copilot
• Languages: Python, Java, C#, Go, JavaScript
• Security & analysis: SAST, DAST, MITRE ATT&CK, OWASP Top 10, CWE
• Tools: Fortify, SonarQube, Checkmarx, Burp Suite, OWASP ZAP
• DevOps & repos: GitLab, Jenkins
• Data: Oracle, PostgreSQL
• Security documentation & governance: SBOMs, RMF, NIST SP 800-53, eMASS, DISA Application Security and Development STIG
• Cloud: AWS/GovCloud

Preferred qualifications

• Certifications such as GWAPT, OSCP, OSWE, CSSLP, PenTest+, CySA+, SecurityX/CASP+, CEH, CISSP, or other relevant certifications.
• Experience with SAST/DAST tools including Fortify, SonarQube, Checkmarx, Burp Suite, or OWASP ZAP.
• Penetration testing, red team, or web application testing experience.
• Experience integrating security checks into CI/CD pipelines using GitLab and Jenkins.
• Experience with SQL and relational databases (Oracle, PostgreSQL) and ETL workflows.
• Familiarity with containers, AWS/GovCloud, software supply chain security, or SBOMs.
• Familiarity with RMF, NIST SP 800-53, eMASS, and the DISA Application Security and Development STIG.
• Experience supporting DoD, U.S. Army, or Intelligence Community missions.