Software Security Testing

Software Security Testing Cybersecurity Jobs

2 jobs found

Today

Cybersecurity Engineer – Application/Software Security

Data Systems Analysts, Inc. Norfolk, VA

Norfolk, VA

Today

$140k - $170k/yr Full time Application Security Cybersecurity Tools Engineer

Apply Now

Job Description

Data Systems Analysts, Inc. is seeking a TS/SCI-cleared Cybersecurity Engineer focused on application and software security for an onsite role at NGIC in Charlottesville, VA. The position is responsible for securing software supporting mission-critical DoD systems through rigorous testing, code review, vulnerability validation, and security tool and process integration.

Role Overview

This position owns software security within the cyber engineering team. The work includes providing technical guidance to strengthen applications, APIs, and back-end services, and ensuring findings are validated and properly addressed prior to release. The engineer applies adversary techniques, threat modeling, and evidence-driven documentation to support RMF and ATO activities.

Key Responsibilities

Own software security for the cyber engineering team, offering technical guidance for securing applications, APIs, and back-end services.
Perform security testing of applications and validate that fixes resolve identified findings.
Review source code against secure coding standards to identify vulnerabilities, insecure design, and exploitable weaknesses.
Implement, tune, and maintain software security tools, including SAST, DAST, dependency scanning, and container scanning, and integrate them into development and release workflows.
Evaluate open-source and commercial cyber tools and source code to determine security risk, fit, and mission adaptability.
Partner with engineers, system admins, architects, ISSOs, and ISSMs to define security requirements and confirm that tools and controls are sufficient.
Assess risk associated with major software changes, unpatched components, and software reaching end of support.
Apply adversary techniques (including MITRE ATT&CK) and threat modeling to prioritize findings based on real-world impact.
Document independent test results, release risk, and technical evidence supporting RMF and ATO activities.
Communicate software risks, findings, and practical remediation steps to technical teams, system owners, and leadership.

Required Qualifications

BS degree in Computer Science, Software Engineering, Computer Information Systems, Cybersecurity, or a related field (experience may substitute for degree).
TS/SCI Clearance.
CompTIA Security+ (DoD 8140 compliant).
Minimum 5 years of combined experience in software development, application security, penetration testing, or secure software assessment.
Hands-on software development experience in at least one language such as Python, Java, C#, Go, or JavaScript, with understanding of back-end services, APIs, and databases.
Demonstrated experience identifying and validating software vulnerabilities via code review, security testing, or technical assessment.
Working knowledge of common application weaknesses (OWASP Top 10, CWE), how they are exploited, and how to remediate them.
Ability to assess exploitability and impact, and communicate clear, practical fixes to engineers and compliance staff.
Ability to work independently as the primary software security resource on a cybersecurity team.

Technologies and Tools

Microsoft Copilot, Python, Java, C#, Go, JavaScript
SAST, DAST, dependency scanning, container scanning
MITRE ATT&CK, OWASP Top 10, CWE
Fortify, SonarQube, Checkmarx, Burp Suite, OWASP ZAP
GitLab, Jenkins, SQL, Oracle, PostgreSQL, AWS/GovCloud
SBOMs, RMF, NIST SP 800-53, eMASS
DISA Application Security and Development STIG

Preferred Experience

Certifications such as GWAPT, OSCP, OSWE, CSSLP, PenTest+, CySA+, SecurityX/CASP+, CEH, CISSP, or other relevant credentials.
Experience with SAST/DAST tooling including Fortify, SonarQube, Checkmarx, Burp Suite, or OWASP ZAP.
Penetration testing, red team, or web application testing experience.
Experience integrating security checks into CI/CD pipelines using GitLab and Jenkins.
SQL and relational database experience (Oracle, PostgreSQL) and familiarity with ETL workflows.
Familiarity with containers, AWS/GovCloud, software supply chain security, or SBOMs.
Familiarity with RMF, NIST SP 800-53, eMASS, and the DISA Application Security and Development STIG.
Experience supporting DoD, U.S. Army, or Intelligence Community missions.

Location and Compensation

Location: Norfolk, VA (onsite).
Salary: USD 140,000 - 170,000 per year.

View full job page →

Today

Cybersecurity Engineer – Application/Software Security

Data Systems Analysts, Inc. Richmond, VA

Richmond, VA

Today

$140k - $170k/yr Full time Application Security Cybersecurity Tools Engineer

Apply Now

Job Description

Data Systems Analysts, Inc. (DSA) is hiring a TS/SCI-cleared Cybersecurity Engineer (Application Security) to help secure software that supports mission-critical systems in a secure DoD environment. In this onsite role, you will own software security activities across the application lifecycle, from testing and code review to integrating security tools and evidence for RMF and ATO efforts.

The position is located in Richmond, VA (onsite). The selected candidate will collaborate with engineering and compliance stakeholders to translate security requirements into practical technical solutions and confirm the right controls are in place.

What you’ll do

Own software security within the cyber engineering team, offering technical guidance to secure applications, APIs, and back-end services.
Perform security testing of applications and validate that remediations resolve identified findings.
Review source code against secure coding standards to identify vulnerabilities, insecure design, and exploitable weaknesses.
Implement, tune, and maintain software security tools, including SAST, DAST, dependency scanning, and container scanning, and integrate them into development and release workflows.
Evaluate open-source and commercial cyber tools and source code to determine fit, security risk, and what can be adapted for mission requirements.
Partner with engineers, system admins, architects, ISSOs, and ISSMs to define security requirements and confirm tools and controls are sufficient.
Assess risk from major software changes, unpatched components, and software reaching end of support.
Use adversary techniques such as MITRE ATT&CK and apply threat modeling to prioritize findings by real-world impact.
Document independent test results, release risk, and technical evidence supporting RMF and ATO activities.
Communicate software risks, findings, and practical fixes to technical teams, system owners, and leadership.

Required qualifications

BS degree in Computer Science, Software Engineering, Computer Information Systems, Cybersecurity, or related field (experience may be substituted for degree).
TS/SCI Clearance.
CompTIA Security+ (DoD 8140 compliant).
Minimum 5 years of combined experience in software development, application security, penetration testing, or secure software assessment.
Hands-on software development experience in at least one language such as Python, Java, C#, Go, or JavaScript, with understanding of back-end services, APIs, and databases.
Demonstrated experience finding and validating software vulnerabilities through code review, security testing, or technical assessment.
Working knowledge of common application weaknesses such as OWASP Top 10 and CWE, including how they are exploited and how to fix them.
Ability to assess exploitability and impact, and communicate clear, practical fixes to engineers and compliance staff.
Ability to work independently as the primary software security resource on a cybersecurity team.

Tools and technologies

Microsoft Copilot
Python, Java, C#, Go, JavaScript
SAST, DAST, dependency scanning, container scanning
MITRE ATT&CK, OWASP Top 10, CWE
Fortify, SonarQube, Checkmarx
Burp Suite, OWASP ZAP
GitLab, Jenkins
SQL, Oracle, PostgreSQL
AWS/GovCloud
SBOMs, RMF, NIST SP 800-53, eMASS
DISA Application Security and Development STIG

Preferred experience / qualifications

GWAPT, OSCP, OSWE, CSSLP, PenTest+, CySA+, SecurityX/CASP+, CEH, CISSP, or other relevant certification.
Experience with SAST/DAST tools such as Fortify, SonarQube, Checkmarx, Burp Suite, or OWASP ZAP.
Penetration testing, red team, or web application testing experience.
Experience integrating security checks into CI/CD pipelines (GitLab, Jenkins).
Experience with SQL and relational databases (Oracle, PostgreSQL) and ETL workflows.
Familiarity with containers, AWS/GovCloud, software supply chain security, or SBOMs.
Familiarity with RMF, NIST SP 800-53, eMASS, and the DISA Application Security and Development STIG.
Experience supporting DoD, U.S. Army, or Intelligence Community missions.

Security clearance and employment notes

Many DSA positions require the ability to obtain a security clearance; security clearances may only be granted to U.S. citizens.
Applicants accepting a conditional offer of employment may be subject to government security investigation(s) and must meet eligibility requirements for access to classified information.
DSA is an Equal Opportunity Employer and an E-Verify Employer.
DSA requires background checks, where permitted by law.

Compensation: USD 140,000 - 170,000 per year.

View full job page →

Software Security Testing Cybersecurity Jobs

Cybersecurity Engineer – Application/Software Security

Cybersecurity Engineer – Application/Software Security

Get Software Security Testing Cybersecurity Jobs alerts