Senior Application Security Engineer

Context: True Anomaly is hiring a Senior Application Security Engineer to help secure mission-critical space systems and support government authorization requirements.

Responsibilities

• Create security architecture documentation and operational security guides for government authorization processes
• Lead a vulnerability management program with defined remediation SLAs by severity (30/90/180 days)
• Conduct security code reviews across Elixir, Python, C++, and JavaScript codebases
• Support triage and management of security automation using SAST (CodeQL, Semgrep), SCA (JFrog Xray), and DAST tooling
• Partner with engineering teams to address security findings and apply secure coding practices
• Develop and deliver security training for software engineers and systems administrators
• Build and maintain application security incident response playbooks
• Evaluate and integrate third-party security solutions to strengthen overall security capabilities

Requirements

• 5+ years experience in application security, product security, or security engineering
• Hands-on experience implementing security controls aligned to compliance frameworks such as NIST 800-171, NIST 800-53, FedRAMP, or CMMC
• Strong software engineering skills, with ability to write production-quality code in at least one language: Python, Rust, Elixir, C++, or similar
• Experience with cloud security (with Azure preferred; AWS or GCP acceptable)
• Knowledge of secure architecture principles, including threat modeling and risk assessment
• Knowledge of authentication and authorization patterns: OAuth2, JWT, RBAC, ABAC
• Knowledge of cryptography and key management
• Knowledge of defense-in-depth and Zero Trust principles
• Track record collaborating with engineering teams to implement controls without blocking velocity
• Eligibility for DoD Secret or TS/SCI clearance

Technologies

• NIST 800-171, NIST 800-53, FedRAMP, CMMC
• Elixir, Python, C++, JavaScript, Rust
• Azure (preferred), AWS, GCP
• OAuth2, JWT, RBAC, ABAC
• CodeQL, Semgrep, JFrog Xray, DAST
• Zero Trust, Threat modeling

Preferred Skills

• Active TS/SCI clearance or ability to obtain and maintain a security clearance
• Direct experience with NIST 800-171 Rev 3 or NIST 800-53 implementation projects (gap analysis, control implementation, evidence collection)
• Experience with Department of Defense Impact Levels (IL2/IL4/IL5/IL6) or STIGs (Secure Technical Implementation Guides)
• Familiarity with Elixir/Erlang/Phoenix or other functional programming ecosystems (Scala, Haskell, F#, OCaml)
• Experience with Azure Government Cloud or other FedRAMP-authorized cloud environments
• Experience using Ghommit tool
• Background in DevSecOps or Platform Security Engineering, including:
  • GitOps workflows and CI/CD security
  • Infrastructure as Code security (Terraform, Bicep, Pulumi)
  • Kubernetes security (Pod Security Standards, network policies, service mesh)
• Experience with security incident response, including detection engineering and SOAR integration
• Familiarity with aerospace, defense, or other highly regulated industries (finance, healthcare, critical infrastructure)
• Previous experience in startups or fast-paced environments, including ability to build processes from scratch

Benefits

• Healthcare: 100% company-paid medical, dental, and vision coverage for you and your dependents, with HSA/HRA options
• Time off: Flexible Time Off (FTO) for exempt employees; accrued PTO up to 25 days for non-exempt employees; plus 12 paid holidays; Parental Leave; Sick Leave
• In-office perks: Daily catered lunch and unlimited snacks
• Retirement and wellness: 401(k) retirement plan, fitness reimbursement, and Dog Fridays
• Total compensation: Equity participation

Location

• Denver, CO (onsite)
• Work location note: candidates must be located near Denver or Long Beach; significant work is completed on site (#LI-Onsite)

Additional Information

• Work environment details: temperature, noise level, inside or outside, and other factors affecting working conditions
• Physical demands: bending, sitting, lifting, and driving
• Export/ITAR citizenship requirement: to conform to U.S. Government space technology export regulations (including ITAR), candidates must be U.S. citizens, lawful permanent residents, protected individuals as defined by 8 U.S.C. 1324b(a)(3), or eligible to obtain required authorizations from the U.S. Department of State

Compensation: USD 180,000 - 240,000 per year