Pennsylvania

Cybersecurity Jobs in Pennsylvania

42 jobs found

Include remote jobs

Today

Application Security Engineer, Information Security

Ascensus Dresher, PA

Dresher, PA

Today

Full time Application Security Data Security DevSecOps

Apply Now

Job Description

Ascensus is hiring an Application Security Engineer to strengthen its application security program and support secure delivery across the software development lifecycle. In this onsite role in Dresher, PA, you will act as a trusted advisor to scrum teams, helping build security into development practices through DevSecOps and ongoing security analysis.

What you’ll do

Protect and ensure proper handling of all confidential data to prevent unauthorized access, improper transmission, and unapproved disclosure.
Bring Ascensus service philosophy and Core Values (People Matter, Quality First, and Integrity Always®) into day-to-day execution.
Partner with security and development leadership to develop a comprehensive, agile, and innovative DevSecOps approach across all phases of the SDLC, identifying and managing risk.
Provide security consultation to scrum teams, application owners, and technology teams on relevant security controls and secure SDLC process.
Participate in sprint planning and decision-making sessions to ensure security requirements and considerations are incorporated into development practices.
Perform application security analysis, including architecture review, data flow analysis, support for penetration testing, and threat modeling.
Build and monitor compliance with application security policies, coding standards, and security controls to mitigate threats.
Own deployment and integration of services that support SAST, DAST, and SCA. Support development teams with static and dynamic testing, triage findings, and provide remediation guidance when needed.
Assist with other tasks and projects as assigned.

What you bring

Minimum 7 years of experience in Secure Software Development and/or DevSecOps (preferred).
Ability to define software security and privacy requirements.
Solid understanding of threat modeling, risk, and mitigation from internal and external threats.
Experience developing system security architecture diagrams and security architecture specifications aligned to security architecture standards.
Experience conducting software security design reviews.
Experience running software security testing tools in a CI/CD pipeline, including Static and Dynamic Application Security Testing and SCA.
Hands-on experience with application testing tools such as Burp Suite, Fiddler, ZAP, Wireshark, and Metasploit.
Experience configuring WAF, API Gateway, and API security tools.
Knowledge of common application and API security risks, including OWASP Top 10 and SANS/CWE Top 25.
Solid understanding of application, database, and network vulnerability testing principles.
Working knowledge of Microsoft SDL, OWASP SAMM, or BSIMM.
Experience assessing secure adoption of third-party components, including open source and commercial software.
.NET/Java experience is a plus.
Understanding of information security frameworks such as ISO27001, NIST, and CSA, and working in regulated environments against FFIEC, SEC, and/or HIPAA requirements.
Strong understanding of authentication and authorization systems and cryptographic standards (encryption, hashing, key management, digital signatures, etc.).
Ability to provide vulnerability remediation guidance and mentor product development software engineers.
Ability to translate security risks into business impact.
Experience running or managing vulnerability assessments using automated tools (for example Nessus, Qualys) and managing penetration testing engagements.
Understanding of privacy regulations related to handling and protecting information.
Experience with fraud detection and analysis as it relates to custom developed applications.
Experience integrating automated testing tools into CI/CD pipelines.
Experience implementing cloud security controls using CSA or cloud provider best practices (such as Azure and AWS).
Experience implementing and supporting security automation tools, including K8 and cloud platform configuration, hardening, and monitoring.

Relevant tools and technologies

SAST, DAST, SCA, Burp Suite, Fiddler, ZAP, Wireshark, Metasploit, WAF, API Gateway, Nessus, Qualys, .NET, Java, ISO27001, NIST, CSA, FFIEC, SEC, HIPAA, OWASP Top 10, SANS/CWE Top 25, Microsoft SDL, OWASP SAMM, BSIMM, CI/CD, DevSecOps, SDLC, K8, Azure, AWS.

View full job page →

1d ago

Experienced Security Analyst

iPipeline Wayne, PA

Wayne, PA

1d ago

Full time Cloud Platforms Cyber Essentials Cyber Security

Apply Now

Job Description

Join iPipeline in Wayne, PA (onsite) as an Experienced Security Analyst, where you’ll help protect systems and data while strengthening the organization’s incident readiness and compliance posture. The role combines hands-on security monitoring, in-depth incident investigation, and security tool management, with opportunities to contribute to planning and reporting across teams. iPipeline offers a competitive compensation and benefits package, career growth opportunities, an employee stock purchase plan, 401(k), and company-matched retirement packages, plus generous time off and flexible work/life balance, an employee wellness program, and an awards and recognition program.

What you’ll do

Monitor and assess security alerts and system events, identifying potential risks, threats, and vulnerabilities across systems and infrastructure.
Implement and refine security controls to mitigate risk and continually improve the organization’s security posture.
Perform regular security audits and assessments, including vulnerability scanning and penetration testing.
Detect, analyze, and investigate security incidents to determine root cause, impact, and appropriate next steps.
Develop and implement remediation strategies for confirmed incidents, ensuring breaches are documented, analyzed, and remediated.
Manage in-scope security tools and continuously evaluate and upgrade them to address evolving threats and compliance requirements.
Coordinate with external vendors or authorities during major incidents such as data breaches.
Apply security frameworks and practices to meet industry regulations, laws, and standards related to data protection, privacy, and industry requirements.
Keep current on regulatory changes and help adjust policies and practices accordingly.
Partner with legal teams to ensure contracts and agreements (including third-party vendor arrangements) meet security and regulatory expectations.
Coordinate with audit teams for internal and external audits, including maintaining audit schedules and tracking remediation efforts.
Interpret and apply regulatory and audit standards (including SOC 2, SOX, and Cyber Essentials), identify compliance gaps, and propose corrective actions.
Conduct risk assessments and evaluate control effectiveness, supporting ongoing governance and improvement.
Assist with employee security training sessions and collaborate with legal, HR, and IT to support consistent security practices.
Provide regular reporting to senior management on security and compliance posture.
Create detailed documentation for audits and compliance reviews, and update and maintain security policies and procedures.
Lead portions of internal audits and participate in external audits.
All other duties as assigned.

What you bring

Ability to assess and mitigate advanced threats such as malware, phishing, and APTs.
Experience conducting forensic analysis on compromised systems and networks.
Proficiency in handling and responding to security incidents and breaches.
Understanding of regulatory frameworks including GDPR, HIPAA, SOC 2, PCI DSS, NIST, and ISO 27001.
Proficiency with network security, cloud security, encryption techniques, firewalls, SIEM (Security Information and Event Management), vulnerability scanning tools, and other security technologies.
Strong written and verbal communication skills for reporting findings and collaborating with teams.

Tools and standards you’ll work with

SIEM (Security Information and Event Management), vulnerability scanning tools, firewalls, network security, cloud security, encryption techniques, and the standards/frameworks including GDPR, HIPAA, SOC 2, PCI DSS, NIST, ISO 27001, SOX, and Cyber Essentials.

View full job page →

1d ago

Product Systems Security Engineer

Lutron Electronics Co., Inc Coopersburg, PA

Coopersburg, PA

1d ago

Full time Automated Security Testing Burp Suite Cloud Platforms

Apply Now

Job Description

In the Product Systems Security Engineer role at Lutron Electronics Co., Inc, you will help shape the cybersecurity of Lutron products, systems, and processes. The position focuses on building security into scalable lighting control solutions and aligning security outcomes with customer and compliance expectations.

Role Responsibilities

Design, test, and validate the cybersecurity of Lutron products, systems, and processes
Translate customer and compliance security requirements for developers, team leaders, and executives
Collaborate across disciplines including software development, sales, legal, and operations
Integrate security into scalable lighting control systems deployed for residential and commercial applications
Work as part of a dedicated security team responsible for organization-wide security initiatives
Develop proficiency across a range of technologies, including IoT Devices, AWS Cloud, Azure Cloud, BurpSuite, Amp, and Vigiles

Required Qualifications

PhD degree in Cybersecurity, or in Computer Science, Computer Engineering, Software Engineering, Information Assurance, Information Systems, or Information Security
Minimum cumulative GPA of 3.00 for each degree earned
Ability and willingness to travel 10-15% for inter-office collaboration and site visits
Authorization to work in the U.S. with no requirement for Lutron sponsorship for a work visa (including H-1B), now or in the future
Availability to work onsite 5 days per week

Technologies and Tools

IoT Devices
AWS Cloud
Azure Cloud
BurpSuite
Amp
Vigiles

Additional Role Overview

As a Product Systems Security Engineer, you will contribute from the beginning to high-impact work that supports Lutron’s leadership in smart lighting and shading systems. The role is structured around cross-functional execution, with an emphasis on applying cybersecurity practices throughout the product lifecycle.

Your team environment includes on-the-job training, supervision by industry experts, and opportunities to attend workshops. As you develop, you may build technical depth through additional expertise or pursue engineering management paths. Growth opportunities may also extend to areas such as product management, manufacturing, quality, and operations.

Product Systems Security Engineers participate with cross-functional teams to conceptualize, design, and develop secure, high-quality consumer products and services for commercial and residential use. The role also involves evaluating cybersecurity practices and direction, contributing improvements from within the team.

Throughout the lifecycle, you may engage with technical areas including DevSecOps and secure design lifecycle, security incident response, security architecture, design, and testing, certificate chains, Customer Identity and Access Management (CIAM), security governance including policies and procedures, and securing Artificial Intelligence.

Location and Work Style

Coopersburg, PA
Onsite role (5 days per week)

View full job page →

2d ago

Senior Aerospace Cybersecurity Engineer

Katalyst Healthcares & Life Sciences Pittsburgh, PA

Pittsburgh, PA

2d ago

Full time Senior Aerospace Aerospace & Defense

Apply Now

Job Description

Pittsburgh, PA (onsite) is the backdrop for this Senior Aerospace Cybersecurity Engineer (Hardware) role, where you will help shape cybersecurity outcomes for aerospace and defense programs. The position combines hands-on technical work with customer-facing collaboration, supporting hardware security and compliance across embedded systems, controllers, and aircraft platforms.

As a senior engineer with aerospace-focused experience, you will lead key cybersecurity activities end-to-end, from threat modeling and security architecture reviews to testing, vulnerability assessments, and support for secure development processes.

Responsibilities

Lead cybersecurity activities for aerospace and avionics programs.
Perform threat modeling, risk assessments, and security architecture reviews.
Support secure software development, including code signing, cryptography, secure boot, and secure firmware update processes.
Conduct cybersecurity testing, vulnerability assessments, and penetration testing.
Define cybersecurity measures for aerospace embedded systems, controllers, and aircraft platforms.
Support compliance with aerospace and federal cybersecurity requirements.
Review customer requirements, RFIs/RFQs, and contribute to proposal development.
Interface with customers, federal contractors, and internal engineering teams.
Support lab-based testing and occasional on-site assessments at customer and aircraft locations.

Requirements

8+ years of cybersecurity engineering experience.
3+ years of aerospace cybersecurity experience.
Aerospace threat modeling and risk assessments.
Embedded systems security.
Cryptography and code signing.
Vulnerability management.
Secure Development Lifecycle (SDLC).
Hardware security and root-of-trust concepts.
Familiarity with aerospace cybersecurity standards such as DO-326A / ED-202A, DO-356A, NIST Cybersecurity Framework, and FIPS 140-3.
Experience supporting ITAR-controlled and/or federal aerospace programs.

Tools & Technologies

DO-326A / ED-202A, DO-356A
NIST Cybersecurity Framework
FIPS 140-3
Secure Development Lifecycle (SDLC)
Cryptography, code signing
Secure boot, secure firmware update processes
Threat modeling, risk assessments, penetration testing
Vulnerability management, root-of-trust concepts
ITAR

Preferred Qualifications

Experience supporting FAA, DoD, defense, or commercial aerospace programs.
Knowledge of aircraft control systems, avionics, and aerospace hardware security architectures.

View full job page →

25d ago

Senior Application Penetration Tester

Chubb Philadelphia, PA

Philadelphia, PA

25d ago

Full time Senior Ai Enabled Security Ai Security

Apply Now

Job Description

Senior Application Penetration Tester focuses on planning and executing security testing across modern application types, then driving remediation visibility and risk reporting to technical and executive stakeholders.

Responsibilities

Plan and conduct penetration tests for web, mobile (iOS & Android), APIs, cloud-native/containerized systems, and AI/LLM-integrated applications
Assess AI/ML and generative AI features for risks including prompt injection, insecure output handling, training data poisoning, model denial of service, and sensitive information disclosure using guidance aligned to OWASP Top 10 for LLM Applications and MITRE ATLAS
Collaborate with AI/ML engineering and data science teams to threat-model AI-powered features and embed security testing into MLOps and CI/CD pipelines
Evaluate cloud-native and containerized workloads and Infrastructure as Code for misconfigurations and weak security controls across AWS, Azure, GCP, Docker, and Kubernetes
Test modern API architectures including REST, GraphQL, and gRPC, with attention to OAuth2, OIDC, and JWT authentication/authorization flaws and microservices-based applications
Perform mobile application security testing and reverse engineering, including analysis for hardcoded credentials, insecure keychain storage, and anti-emulator/obfuscation bypass
Own overall vulnerability remediation status for the global application portfolio and act as a primary contact for application teams on remediation
Manage application risk rating processes and support timely risk scoring for new and changing applications
Build and maintain dashboards and status reports for portfolio leads and CIOs, including follow-up on overdue vulnerabilities to meet compliance timelines
Create clear, actionable penetration test reports and communicate findings and a remediation strategy to both technical and executive stakeholders
Research emerging attack techniques and tooling, and drive automation and process improvements across the testing program

Requirements

Prior experience managing Information Security projects
Bachelor’s Degree in Computer Science, Engineering, or another Engineering or Technical discipline, or equivalent relevant experience
Minimum 2 years of professional experience performing penetration testing for web application, API endpoint, and mobile (iOS & Android)
Knowledge of prioritizing remediation activities with operational teams using risk ratings of vulnerabilities and assets
Knowledge of vulnerability management standards, including CVE and CVSS
Knowledge across network security, wireless security, application security, infrastructure hardening and security baselines, and web server and database security
Knowledge of penetration testing principles, tools, and techniques
Working experience with industry frameworks such as OWASP, OWASP API Security Top 10, OWASP Top 10 for Large Language Model (LLM) Applications, NIST, NIST AI Risk Management Framework, and MITRE ATT&CK
Comfort working outside comfort zone with willingness to learn
Excellent verbal and written communication skills
Strong analytical skills
Strong team player with ability to work independently
Strong project management skills and ability to multi-task
Self-motivated with strong initiative
Knowledge of computer networking concepts and protocols and application security methodologies
Skill in performing impact/risk assessments
Familiarity with modern application architectures including cloud-native (AWS, Azure, GCP), containerized (Docker, Kubernetes), microservices, and API-first designs (REST, GraphQL, gRPC)
Foundational understanding of AI/ML and generative AI security risks such as prompt injection, model manipulation, and sensitive data leakage is a plus

Technologies

AWS, Azure, GCP, Docker, Kubernetes, Infrastructure as Code
REST, GraphQL, gRPC, OAuth2, OIDC, JWT
MLOps, CI/CD
OWASP, OWASP API Security Top 10, OWASP Top 10 for Large Language Model (LLM) Applications, OWASP Top 10 for LLM Applications
NIST, NIST AI Risk Management Framework, MITRE ATT&CK, MITRE ATLAS
CVE, CVSS
Kali Linux, Metasploit, Nmap, Burp Suite, OWASP ZAP, Santoku
Genymotion, APKTool, JD-GUI, SQLMap, Semgrep, Snyk, Checkmarx, AppScan, Veracode
Trivy, Grype, Prowler, ScoutSuite, Garak, PyRIT, OWASP ASVS
OSCP, OSWE, GWAPT, GPEN, CEH, GCPN, CCSP
LangChain, Semantic Kernel, AutoGen, RAG vector databases

Location: Philadelphia, PA (onsite)

View full job page →

25d ago

Cybersecurity Analyst

GEM Technology, Inc. West Mifflin, PA

West Mifflin, PA

25d ago

$110k - $150k/yr Contract Cybersecurity Tools Fedramp Information Security

Apply Now

Job Description

Cybersecurity subcontractor role supporting National Institute of Standards and Technology (NIST) Risk Management Framework (RMF) deliverables in an onsite environment.

Responsibilities

Support and execute NIST RMF directives across the full RMF workflow.
Assist information system owners with development of System Security Plans (SSPs) and Security Assessment Reports (SARs) to support information system authorization.
Use the existing RSA Archer application on Naval Nuclear Propulsion Network (NNPP Net) to complete authorization package tasks.
Support creation of Plans of Action and Milestone (POA&Ms) and Risk Based Decisions (RBDs) for deficiencies identified during the authorization process.

Requirements

4+ years combined experience in one or more of the following roles: security control validator, security control assessor, Information System Security Officer (ISSO), or Information System Security Manager (ISSM).
2+ years supporting development of information system security authorization packages aligned to NIST 800-37, NIST 800-53, and NIST 800-53a under RMF.
2+ years experience working with FedRAMP.
CompTIA Security+ certification.
US citizen only. Applications from Visa or Green Card holders are not accepted at this time.
Department of Energy Q Clearance required, or ability to obtain.

Key Technologies

RSA Archer application
NNPP Net (Naval Nuclear Propulsion Network)
RMF
NIST 800-37, NIST 800-53, NIST 800-53a
FedRAMP

Location

West Mifflin, PA (onsite)
Schenectady, NY (onsite)
Positions to be filled: one candidate at each location, or both candidates at a single location.
Preferred: West Mifflin, PA 15122

Work Schedule / Telework

25% teleworking
75% onsite required in West Mifflin, PA and/or Schenectady, NY
25% willingness to travel (required)
In person work location

Security Clearance & Timing

Department of Energy Q Clearance needed or ability to obtain.
Start date will be delayed until clearance is approved (could be 6 months or longer).
Security clearance requirement listed as Top Secret (Required).

Job Duration

1 year + 4 option years

Salary

USD 110,000 - 150,000 per year, based on qualifications and experience
Pay listed as $110,000.00 - $150,000.00 per year

Employment Type

Contract subcontractor
Job type also listed as Full-time, Contract

Education

Associate (Required)

Benefits

Dental insurance
Health insurance
Life insurance
Paid time off
Vision insurance

View full job page →

1mo ago

Application Security Engineer

Wawa, Inc. Media, PA

Media, PA

1mo ago Closed

Full time Application Security Container Security Engineer

This position is no longer accepting applications (closed Sep 17, 2026).

Job Description

Wawa, Inc. is seeking an Application Security Engineer to help strengthen security across the software lifecycle for internally developed applications. This onsite role in Media, PA focuses on day-to-day application security operations, improving the application security program, and serving as a technical resource to support secure software development throughout the SDLC.

The successful engineer will collaborate closely with developers and product owners, support secure coding practices, and help identify and remediate application and platform security risks. In addition to threat research and vulnerability management, the role supports reviews, testing activities, incident response participation, audit readiness, and internal enablement through security presentations.

Responsibilities

Support security best practices in the software development lifecycle by partnering with developers and product owners to secure applications at all stages.
Research, identify, and communicate current and emerging application security threats, along with applicable solutions.
Maintain and iterate on secure coding practices, policies, standards, and procedures.
Test applications for security threats and vulnerabilities.
Support application security vulnerability management.
Create and deliver security presentations for internal audiences, both technical and non-technical.
Identify security design gaps in existing and proposed applications and recommend changes or enhancements.
Continually assess the Application Security Program for gaps and inefficiencies, then propose solutions.
Participate in and support application security reviews, penetration tests, and threat modeling.
Contribute to internal security-focused program direction.
Assist with developing metrics and a reporting framework to measure program effectiveness.
Support development and maintenance of technology security policies and standards, ensuring their application to technology architectures.
Assist with ongoing compliance with regulatory obligations and internally developed policies and standards.
Provide support to the Technology Security Incident Response team during cyber incidents.
Maintain internal relationships across information security, information technology, and development teams to support alignment on initiatives.
Maintain external relationships with industry peers, ecosystem partners, vendors, and other parties to address shared trends, findings, and cybersecurity risks.
Serve as a technical resource for internal business teams and the IT department to plan, implement, and support new and existing software.
Support audit and assessment activities for IT, including the annual PCI audit, IT general controls review, and other audits or assessments related to security and general IT controls.
Provide application security guidance on IT and business-related projects as required, and participate in IT and security related projects.
Work with business units to facilitate application security engineering requirements and advocate for application security best practices.

Requirements

Minimum 2 years of experience in a complex technology environment in the application security engineering field.
Proven experience securing custom software.
Ability to work individually and collaboratively in a team environment.
Ability to learn on the job and effectively track task progress.
Experience working with teams of developers and product owners.
Strong written and verbal communication skills, including the ability to explain application security and risk concepts to diverse audiences.
Poise and ability to act calmly in high-pressure, high-stress situations.
Critical thinking and strong problem-solving skills.
Ability to manage multiple projects with strict timelines in a demanding, dynamic environment.
Ability to engage in internal security technology and security remediation projects.
Ability to understand large technology implementations spanning hundreds of physical and virtual environments.
High personal integrity and ability to handle confidential matters with appropriate judgment and maturity.
High initiative and dependability, resilient to change, and able to work with limited supervision.
Ability to participate in on-call 24x7x365 rotation for information security incidents.
Advanced knowledge of containers and container security.
Solid knowledge of cloud technology and security.
Solid knowledge of Java programming.
Basic knowledge of Golang programming.
Basic knowledge of React and React Native programming.
Experience reading and writing enterprise software.
Experience preventing and remediating software security flaws in enterprise software.
Up-to-date knowledge of common security weaknesses and flaws, including prevention and remediation.
Advanced knowledge of OWASP guidance.
Solid knowledge of web-related protocols such as TCP/IP, HTTP, HTTPS, and REST.
Understanding of relevant legal and regulatory requirements such as Payment Card Industry Data Security Standard (PCI DSS).
Degree in computer science preferred, or equivalent professional experience.
Professional security management certification preferred, such as CISSP, CISM, GDSA, CSSLP, CEH, etc.
Solid knowledge of information security management frameworks such as Critical Security Controls, and NIST 800-53 and the Cybersecurity Framework.
Significant knowledge of application security concepts and technologies including SAST, DAST, SCA, IaC, cryptography, authn/authz, and API security.
Strong understanding of cloud, application security, and software engineering principles.
Experience with scripting and automation (including Python, PowerShell, Unix shell, JavaScript, and TypeScript).
Proven experience and strong understanding of DevSecOps and SAFE Agile working methodologies.