Cybersecurity Engineer III (AppSec)

Sierra Nevada Corporation (hybrid, Lone Tree, CO) is building secure systems with a focus on practical security engineering. As a Cybersecurity Engineer III (AppSec), you will help strengthen application and platform defenses by designing, testing, and implementing security controls, integrating automated tooling into delivery pipelines, and advising teams as they build. The role includes a clear benefits package, tuition reimbursement, and time off to support sustainable performance.

What you’ll do

• Conduct application security analysis using automated tooling such as SAST, SCA, and DAST, along with code reviews, to help development teams understand, triage, and remediate vulnerabilities.
• Review proposed designs for security control implementations and secure design, working with developers to embed security into system and application architecture.
• Partner with DevOps engineers to integrate and maintain automated security tooling and gates inside CI/CD workflows.
• Audit the security scan tool and security gate configurations to ensure alignment with enterprise security standards, supporting continuous improvements to workflow and tooling design.
• Advise the business on AI-augmented Application Security measures and other emerging AppSec improvements, including research, recommendations, and integration.
• Act as a trusted security partner to developers, supporting a security culture within development teams.
• Collaborate with development teams to enable secure innovation while maintaining developer velocity and business outcomes.

Required qualifications

• Bachelor’s degree in Cybersecurity, Network Engineering, Information Technology, or a related Engineering field of study.
• 5+ years of experience in a related role.
• Relevant experience may replace education requirements; without a degree, a minimum of 9 years of related experience is required.
• A higher level relevant degree may substitute for experience.
• 3+ years experience focused on application security or DevOps/DevSecOps.
• Strong understanding of core cybersecurity principles across the secure software design and system development lifecycle, including identity and access management, secrets management, integration security, encryption and data handling, audit logging and monitoring, and supply chain security.
• Demonstrated experience across the system development lifecycle: planning, requirements, design, implementation, testing, deployment, and maintenance.
• Hands-on experience configuring and integrating security tools and requirements into CI/CD workflows.
• Hands-on experience analyzing source code and security tool outputs, including evaluating exploitability and risk, and triaging findings appropriately.
• Strong knowledge of secure coding practices and DevSecOps principles.
• Demonstrated ability to communicate and collaborate with development teams as a trusted security partner.
• Working knowledge of NIST SP 800-171, NIST SP 800-218, and OWASP.
• Proven experience with security monitoring and assessment tools.
• Experience supporting, troubleshooting, and administering networks, Operating Systems, and applications.
• Advanced knowledge of data security administration principles, methods, and techniques.
• Strong knowledge and experience administering a variety of current Microsoft platforms.
• In-depth understanding of domain structures, user authentication, and digital signatures.
• Ability to obtain and maintain a Secret U.S. Security Clearance is required.

Technologies you may work with

• SAST, SCA, DAST
• SonarQube, Semgrep, Trivy
• JFrog Xray, JFrog Artifactory
• GitHub Actions
• Terraform, Ansible
• NIST SP 800-171, NIST SP 800-218, OWASP

Benefits

• Medical, dental, and vision plans
• 401(k) with 150% match up to 6%
• Life insurance
• 3 weeks paid time off
• Tuition reimbursement

Preferred qualifications

• Experience with SonarQube, Semgrep, Trivy, JFrog Xray, JFrog Artifactory, GitHub Actions, Terraform, and Ansible
• Proficiency in one or more programming languages such as C++, Python, or JavaScript
• Demonstrated experience designing and implementing Policy as Code
• Understanding of Infrastructure as Code and cloud native application technologies including Kubernetes, Docker, and API management
• Understanding of AI system security principles
• Demonstrated experience securing applications with AI components

Essential functions

• Ability to work in an office or hybrid environment
• Prolonged periods sitting and working on a computer
• Ability to lift up to 20 pounds occasionally
• Ability to travel as needed

Security clearance notice

This position requires the ability to obtain and maintain a Secret U.S. Security Clearance. U.S. citizenship status is required because an active U.S. Security Clearance is needed for employment. Non-U.S. citizens may not be eligible to obtain a security clearance.

Compensation: USD 131,010 - 180,138 per year. Location: Lone Tree, CO (hybrid). Experience: Minimum 3 years.