Join our team that owns the application security scanning ecosystem for a federal agency, running software composition analysis, static and dynamic testing, and container security across the full software development life cycle. You will deploy, harden and operate Sonatype, Fortify, StackRox and Burp Suite in accredited environments, wire them into CI/CD with policy based gating, and tune them so engineering teams get findings they can act on instead of noise. You will also manage at least one other AppSec engineer and advise senior leadership on which tools earn their place in the stack.

What You Will Do

• Deploy, configure, harden and maintain Sonatype, Fortify, StackRox and Burp Suite in on premise and accredited cloud environments
• Manage upgrades, plugins, licensing, capacity planning, backup and restore, high availability and disaster recovery
• Establish SLAs and SLOs, monitoring and alerting, and operational runbooks
• Integrate scanning tools into CI/CD pipelines such as Jenkins and GitLab CI with policy based gating and risk based exceptions
• Standardize secure by default developer workflows: pull request checks, nightly scans, release readiness criteria
• Build reusable templates and reference implementations for product teams
• Define and tune scanning policies: severity thresholds, exploitability context, allowlists and denylists, quality gates
• Reduce false positives and negatives through rule tuning, calibration and developer feedback loops
• Maintain an auditable vulnerability management workflow covering triage, ownership, remediation SLAs and waiver documentation
• Deliver findings with clear reproduction steps and secure coding guidance, then coordinate retesting and verify fixes
• Implement image scanning, runtime detections, admission controls and Kubernetes policy enforcement in StackRox
• Produce metrics and dashboards on vulnerability trends, time to remediate, pipeline pass rates and policy exceptions
• Support RMF and ATO evidence needs with scan outputs, control mappings and procedures
• Manage and mentor at least one other application security engineer
• Perform tool assessments and present consolidation recommendations to senior executive leadership

Required Qualifications

• 5+ years in application security engineering or DevSecOps in regulated environments
• Hands on administration and pipeline integration with Sonatype, specifically Nexus IQ or Lifecycle
• Hands on administration and pipeline integration with Fortify, SCA and SSC
• Hands on administration and pipeline integration with StackRox or Red Hat Advanced Cluster Security
• Hands on work with Burp Suite, Professional or Enterprise preferred
• Strong CI/CD and automation skills, with repeatable integrations and policy gates
• Secure SDLC, OWASP Top 10, dependency risk, SBOM concepts, container and Kubernetes security
• Linux administration, networking fundamentals, TLS and certificate management, identity integration through SSO or LDAP
• Common languages and build systems: Java with Maven or Gradle, .NET with NuGet, Node with npm, Python with pip
• Oracle Cloud Infrastructure
• Active DoD Secret clearance (U.S. citizenship required)
• DoD 8570 IAT II certification, such as Security+

Preferred Qualifications

• Oracle Cloud certifications
• DoD or IC work with RMF, STIGs and vulnerability management processes
• Registries and orchestration: Harbor, Artifactory, ECR, Kubernetes, OpenShift, Helm
• Integration with SIEM, SOAR and ticketing tools such as Splunk, ServiceNow and Jira
• Agile delivery with hands on Jira
• CISSP, CSSLP, GIAC or a Kubernetes security certification