CybersecurityJobs.io
← Back to all jobs
Data Systems Analysts, Inc.

Cybersecurity Engineer – Application/Software Security

Data Systems Analysts, Inc.
Washington, DC $140k - $170k/yr Full time Posted 1h ago
Application Security Cybersecurity Tools Engineer Information Security InfoSec Security Security Automation Security Clearance Security Compliance Security Testing Software Security
Apply Now

Job Description

Data Systems Analysts, Inc. is seeking a TS/SCI-cleared Cybersecurity Engineer focused on application and software security at an onsite NGIC role in Washington, DC (Charlottesville, VA). The position supports DoD mission systems by testing and improving application security, translating security requirements into technical solutions, and documenting evidence for RMF and ATO activities.

Location and Clearance

  • Location: Washington, DC (onsite)
  • Security Clearance: TS/SCI

Compensation

  • Salary: USD 140,000 to 170,000 per year

Key Responsibilities

  • Own software security within the cyber engineering team, providing technical guidance to secure applications, APIs, and back-end services.
  • Conduct security testing of applications and validate that fixes address identified findings.
  • Review source code against secure coding standards to identify vulnerabilities, insecure design, and exploitable weaknesses.
  • Implement, tune, and maintain software security tools such as SAST, DAST, dependency scanning, and container scanning, and integrate them into development and release processes.
  • Evaluate open-source and commercial cyber tools and source code to determine suitability, security risk, and what can be adapted for mission requirements.
  • Partner with engineers, system admins, architects, ISSOs, and ISSMs to define security requirements and confirm tools and controls are sufficient.
  • Assess risk associated with major software changes, unpatched components, and software reaching end of support.
  • Apply adversary techniques (including MITRE ATT&CK) and threat modeling to prioritize findings based on real-world impact.
  • Document independent test results, release risk, and technical evidence supporting RMF and ATO activities.
  • Communicate software risks, findings, and practical fixes to technical teams, system owners, and leadership.

Required Experience

  • Minimum 5 years of combined experience in software development, application security, penetration testing, or secure software assessment.
  • Hands-on software development experience in at least one language: Python, Java, C#, Go, or JavaScript, with understanding of back-end services, APIs, and databases.
  • Demonstrated ability to find and validate software vulnerabilities through code review, security testing, or technical assessment.
  • Working knowledge of OWASP Top 10 and CWE, including how weaknesses are exploited and how to remediate them.
  • Ability to assess exploitability and impact and communicate practical fixes to engineers and compliance staff.
  • Ability to work independently as the primary software security resource on a cybersecurity team.

Required Education, Certifications, and Security Clearance

  • Education: BS degree in Computer Science, Software Engineering, Computer Information Systems, Cybersecurity, or related field
  • Substitution: Experience may be substituted for degree
  • Clearance: TS/SCI Clearance
  • Certification: CompTIA Security+ (DoD 8140 compliant)

Preferred Qualifications

  • GWAPT, OSCP, OSWE, CSSLP, PenTest+, CySA+, SecurityX/CASP+, CEH, or CISSP, or other relevant certification.
  • Experience with SAST/DAST tools such as Fortify, SonarQube, Checkmarx, Burp Suite, or OWASP ZAP.
  • Penetration testing, red team, or web application testing experience.
  • Experience integrating security checks into CI/CD pipelines using GitLab and/or Jenkins.
  • Experience with SQL and relational databases (Oracle, PostgreSQL) and ETL workflows.
  • Familiarity with containers, AWS/GovCloud, software supply chain security, or SBOMs.
  • Familiarity with RMF, NIST SP 800-53, eMASS, and the DISA Application Security and Development STIG.
  • Experience supporting DoD, U.S. Army, or Intelligence Community missions.

Technologies and Standards

  • Microsoft Copilot
  • Programming: Python, Java, C#, Go, JavaScript
  • Security testing: SAST, DAST
  • Standards and frameworks: OWASP Top 10, CWE, MITRE ATT&CK, RMF, ATO, NIST SP 800-53, eMASS, DISA Application Security and Development STIG
  • Tools: Fortify, SonarQube, Checkmarx, Burp Suite, OWASP ZAP, GitLab, Jenkins
  • Databases and data: SQL, Oracle, PostgreSQL, ETL
  • Cloud and supply chain: Containers, AWS/GovCloud, SBOMs
  • Additional references (as listed): CompTIA Security+, GWAPT, OSCP, OSWE, CSSLP, PenTest+, CySA+, SecurityX/CASP+, CEH, CISSP

Similar Jobs