Application Security Engineer

Job Summary

The Cyber Architecture & Advisory Services is seeking an Application Security Engineer to work under the direction of an Application Security Subject Matter Expert (SME) in support of multiple DHS S&T Research, Development, & Innovation (RD&I) efforts. The Application Security Engineer will conduct Independent Verification and Validation (IV&V) of mission critical software applications protecting the homeland's Land, Sea (Maritime), Air, Space, and Cyberspace domains.

Responsibilities

• Evaluate and analyze application software and firmware source code and binaries for exploitable weaknesses
• Utilize application security testing tools to identify potential vulnerabilities
• Conduct Static Application Security Testing (SAST) on source code repositories and executable binaries
• Research exploitation methods and develop exploits for identified vulnerabilities
• Write vulnerability remediation recommendations, including updates, source code corrections, or other mitigations
• Write in-depth software security reports that include summarized findings and describe the risks
• Present findings to software development teams
• Brief assessment results to senior leadership and executives
• Reverse engineer application software and firmware binaries when required under the guidance of the Senior Application Security Engineer
• Evaluate and analyze leading edge security technologies to improve the organization's security posture
• Work with research and development (R&D) organizations to define requirements to design and develop leading-edge security solutions
• Collaborate with fellow Cyber Security Practice Team Members in the full-lifecycle development and delivery of security technology solutions
• Actively contribute to the Battelle Cyber process improvement initiatives
• Actively participate in leading edge cyber security conferences, working groups and training

Key Qualifications

• Active DoD SECRET Clearance or DHS EOD or FSA Background Investigation status; US Citizenship required
• 5+ years software engineering experience with compiled and interpretive programming languages
• 4+ years of experience in information assurance and/or cybersecurity
• Bachelors Degree (BS/BA)
• Experience with decompiling and reverse engineering tools such as Ghidra and JDecompiler
• Experience with SAST tools such as Black Duck Coverity
• Experience with software composition analysis tools such as Anchore Syft
• Familiarity with Software Bills of Materials (SBOMs)
• Experience with virtual machines
• Experience with common Linux distributions, such as Ubuntu and Red Hat
• Experience programming in Java, C/C++, C#/.NET, Python, and JavaScript
• Proven experience working in collaborative sessions demonstrating strong verbal and written communication skills along with tactful negotiation skills
• Certified Information Systems Professional (CISSP)

Preferred Qualifications

• Current DHS Security Suitability
• M.S. in Information Systems or related field
• Certified Secure Software Lifecycle Professional (CSSLP)
• Experience with Ruby, Rust, Go, TypeScript, and PHP
• Experience with Continuous Integration / Continuous Development (CI/CD) Pipelines
• Penetration Testing experience and/or certifications
• Experience with C-UAS, Sea (Maritime), Air, and/or Border operations and DHS systems
• Experience with IT Security Engineering in support of systems development, interface, and/or architecture requirements and concepts
• Familiarity with MITRE ATT&CK Framework
• Familiarity with NIST SP 800-53 Rev. 5
• Familiarity with DHS 4300A
• Experience with cloud application security
• Experience with cloud environment operations
• Consulting environment experience
• Military veteran with relevant Application Security, IT and computer security experience