Cybersecurity Jobs in Monterey, CA

1 job found

Include remote jobs

Today

Application Security Tooling Engineer

ADVANCED ONION INC Monterey, CA

Monterey, CA

Today

Full time Application Security Application Security Testing Cloud Platforms

Apply Now

Job Description

Monterey-based AppSec tooling engineer role focused on building and improving a regulated, end-to-end application security scanning ecosystem across the SDLC.

Responsibilities

Design, operate, and continuously improve the defense agency’s application security (AppSec) scanning ecosystem across the SDLC.
Run and integrate SCA with Sonatype, SAST with Fortify, container/Kubernetes security with StackRox (Red Hat Advanced Cluster Security), and DAST with Burp Suite in regulated environments.
Deploy, configure, harden, and maintain Sonatype, Fortify, StackRox, and Burp across on-prem and/or accredited cloud environments.
Manage upgrades, plugins, licensing, capacity planning, backup/restore, high availability, and disaster recovery.
Establish SLAs/SLOs, monitoring/alerting, and operational runbooks.
Integrate scanning into CI/CD pipelines (e.g., Jenkins, GitLab CI) using policy-based gating and risk-based exceptions.
Standardize developer “secure-by-default” workflows, including pull request checks, nightly scans, and release readiness criteria.
Create reusable templates and reference implementations for product teams.
Define and tune scanning policies: severity thresholds, exploitability context, allowlists/denylists, and quality gates aligned to agency standards.
Reduce false positives/negatives through rule tuning, calibration, and developer feedback loops.
Maintain an auditable vulnerability management workflow covering triage, ownership, remediation SLAs, and exception/waiver documentation.
Provide actionable findings with reproduction steps and secure coding guidance.
Partner with engineering to remediate issues across code, dependencies, container images, and Kubernetes configurations.
Coordinate retesting and verify fixes, including targeted Burp validation for high-risk apps/APIs.
Implement image scanning, runtime detections, admission controls, and Kubernetes policy enforcement.
Integrate with registries and orchestration platforms; maintain cluster baselines and least-privilege controls.
Operationalize incident-ready detections and response playbooks with SOC/IR teams.
Produce metrics and dashboards for vulnerability trends, time-to-remediate, pipeline pass rates, and policy exceptions.
Support Risk Management Framework (RMF) / Authority to Operate (ATO) evidence needs using scan outputs, control mappings, and procedures.
Experience supporting Agile project management; hands-on Jira experience strongly preferred.
Manage a team of at least one other AppSec professional.

Requirements

Active Secret clearance required.
5+ years in application security engineering and/or DevSecOps in regulated environments.
Hands-on administration and pipeline integration experience with Sonatype (Nexus IQ/Lifecycle), Fortify (SCA/SSC), StackRox/Red Hat ACS, and Burp Suite (Professional/Enterprise preferred).
Strong CI/CD and automation skills for repeatable integrations and policy gates.
Working knowledge of Secure SDLC, OWASP Top 10, dependency risk, and SBOM concepts, plus container/Kubernetes security.
Working knowledge of Linux administration, networking fundamentals, TLS/cert management, and identity integration (SSO/LDAP).
Working knowledge of common languages/build systems: Java/Maven/Gradle, .NET/NuGet, Node/npm, Python/pip.
Working knowledge of Oracle Cloud Infrastructure.
DoD/IC experience with RMF, STIGs, and vulnerability management processes.

Technologies

Sonatype (Nexus IQ/Lifecycle)
Fortify (SCA/SSC)
StackRox (Red Hat Advanced Cluster Security / Red Hat ACS)
Burp Suite (Professional/Enterprise)
Oracle Cloud Infrastructure
Jenkins, GitLab CI, Jira
OWASP Top 10, SBOM concepts
Linux, TLS, SSO, LDAP
Java, Maven, Gradle, .NET, NuGet, Node, npm, Python, pip
Harbor, Artifactory, ECR
Kubernetes, OpenShift, Helm
Splunk, ServiceNow, SIEM, SOAR
RMF, ATO, STIGs

Preferred Qualifications

Familiarity with registries and orchestration: Harbor/Artifactory/ECR, Kubernetes/OpenShift, Helm.
Experience integrating with SIEM/SOAR and ticketing (e.g., Splunk, ServiceNow, Jira).
Relevant certifications (one or more): Security+, CISSP, CSSLP, GIAC, Kubernetes security certs.

Location: Monterey, CA (onsite)

Minimum experience: 5+ years

View full job page →

Get Cybersecurity Jobs in Monterey, CA alerts

New Cybersecurity Jobs in Monterey, CA, daily.