Application Security Engineer

Job Description

We seek a experienced Application Security Engineer to join the DevSecOps Team of the Joint Mission Integration and Experimentation (JMIE) Division within the Information Advantage Office at the Applied Research Laboratory (ARL) at Penn State, based in San Diego, CA . The JMIE Division delivers advanced communications capabilities and secure experimentation networks supporting departmental mission partners, including cross‑domain data movement, tactical compute environments, and resilient edge processing strengthen secure software design, development, and deployment across our mission‑focused environments. You will champion application security best practices, embed security across the software development lifecycle, and work closely with engineering teams to ensure applications are resilient, compliant, and securely architected from concept to production.

You will:

• Lead the integration of application security best practices into Agile and DevSecOps workflows, ensuring security requirements are included from initial design through deployment
• Conduct deep‑dive secure code reviews, threat modeling, and architecture analysis to identify vulnerabilities and guide remediation strategies
• Perform static (SAST), dynamic (DAST), and interactive application security testing, ensuring coverage across microservices, APIs, and containerized applications
• Develop and maintain secure coding standards, patterns, and guidance used across engineering teams
• Partner with developers and product owners to ensure secure design decisions, using approaches such as least privilege, secure defaults, zero‑trust principles, and defense‑in‑depth
• Manage and optimize tools supporting application security, including SAST/DAST platforms, software composition analysis (SCA), secret‑scanning, and container/CI pipeline security tool
• Evaluate open‑source and third‑party components for vulnerabilities, license risks, and supply chain integrity
• Guide teams in secure API development, authentication/authorization best practices, cryptographic use, and secure data handling
• Validate security controls and perform risk analysis for applications undergoing release, modernization, or cloud migration
• Assist in building a security‑focused engineering culture through training, documentation, and hands‑on developer engagement
• Collaborate with cybersecurity, cloud, and network teams to ensure application security aligns with enterprise risk, RMF requirements, and overall mission objectives
• Strong background in application security, including secure development practices, vulnerability analysis, and secure design principles
• Versed in SAST, DAST, SCA, and CI/CD security integration

Required:

• Proficiency with secure coding techniques in one or more languages (e.g., Python, Java, C#, JavaScript/TypeScript, Go)
• Experience reviewing application architectures, microservices, and containerized workloads for security weaknesses
• Familiarity with NIST 800‑53 or similar control frameworks as they relate to application-level security requirements
• Strong understanding of authentication, authorization, encryption, and API security best practices
• Strong background in cybersecurity disciplines, including vulnerability management, scanning, compliance evaluation, and control implementation
• Experience interpreting security policy, generating evidence, and documenting test results for NIST 800‑53 / JSIG security controls
• Active TS/SCI clearance

Preferred:

• Experience operating within DevSecOps pipelines and modern CI/CD ecosystems
• Knowledge of cloud-native application security (AWS, Azure, or DoD cloud environments)
• Experience with secure design reviews for APIs, distributed systems, mobile applications, or cross-domain solutions
• Background with eMASS, STIGs, or ACAS in support of application accreditation efforts
• Relevant certifications: CSSLP, GWAPT, GWEB, GCSA, GSSP, or CISSP
• Prior experience delivering developer security training or building secure coding programs