Application Security Engineer III

True Anomaly • Denver, CO

2d • Onsite

About The Position

True Anomaly is seeking an Application Security Engineer III to implement and audit security controls for mission-critical space systems subject to stringent government compliance requirements. The role combines security engineering, NIST 800-171 and NIST 800-53 compliance, and cloud-native architectures to help ensure satellite mission control software and flight systems meet Department of Defense security standards. The engineer will design and implement application-level controls, including audit logging, incident response capabilities, access controls, and security monitoring, and work with product engineering teams to integrate security into development. The position requires the ability to obtain and maintain a security clearance. Candidates must be located near Denver or Long Beach, and significant work is performed onsite.

The position is open until filled. Applicants must meet U.S. Government space technology export-regulation requirements: be a U.S. citizen, lawful permanent resident, protected individual under 8 U.S.C. 1324b(a)(3), or eligible to obtain the required U.S. Department of State authorizations.

Requirements

• At least 3 years of experience in application security, product security, or security engineering.
• Hands-on experience implementing security controls for compliance frameworks such as NIST 800-171, NIST 800-53, FedRAMP, or CMMC.
• Strong software engineering skills, including the ability to write production-quality code in at least one language such as Python, Rust, Elixir, C++, or a similar language.
• Experience with cloud security; Azure is preferred, while AWS or GCP is acceptable.
• Solid understanding of secure architecture principles, including threat modeling and risk assessment; authentication and authorization patterns such as OAuth2, JWT, RBAC, and ABAC; cryptography and key management; and defense-in-depth and Zero Trust principles.
• Proven ability to collaborate with engineering teams to implement security controls without blocking development velocity.
• Eligible for a DoD Secret or TS/SCI clearance; the role requires the ability to obtain and maintain a security clearance.
• Must be located near Denver or Long Beach; significant work must be performed onsite.
• Must be a U.S. citizen, lawful permanent resident, protected individual under 8 U.S.C. 1324b(a)(3), or eligible to obtain the required U.S. Department of State authorizations under U.S. Government space technology export regulations.

Nice To Haves

• Active TS/SCI clearance or ability to obtain and maintain a security clearance.
• Direct experience with NIST 800-171 Rev 3 or NIST 800-53 implementation projects, including gap analysis, control implementation, and evidence collection.
• Experience with Department of Defense Impact Levels (IL2, IL4, IL5, or IL6) or STIGs (Secure Technical Implementation Guides).
• Familiarity with Elixir/Erlang/Phoenix or functional programming ecosystems such as Scala, Haskell, F#, or OCaml.
• Experience with Azure Government Cloud or other FedRAMP-authorized cloud environments.
• Experience using the Ghommit tool.
• Background in DevSecOps or Platform Security Engineering, including GitOps workflows and CI/CD security, Infrastructure as Code security (Terraform, Bicep, or Pulumi), and Kubernetes security (Pod Security Standards, network policies, or service mesh).
• Experience with security incident response, including detection engineering and SOAR integration.
• Familiarity with aerospace, defense, or other highly regulated industries such as finance, healthcare, or critical infrastructure.
• Previous experience in startups or fast-paced environments, with the ability to build processes from scratch.

Responsibilities

• Create security architecture documentation and operational security guides for government authorization processes.
• Drive a vulnerability management program with defined remediation SLAs of 30, 90, or 180 days by severity.
• Perform security code reviews for Elixir, Python, C++, and JavaScript codebases.
• Collaborate in triage and management of security automation using SAST tools such as CodeQL and Semgrep, SCA tools such as JFrog Xray, and DAST tools.
• Collaborate with engineering teams to address security findings and implement secure coding practices.
• Develop and deliver security training to software engineers and systems administrators across the organization.
• Create and manage incident response playbooks for application security events.
• Evaluate and integrate third-party security solutions to enhance security capabilities.

Benefits

• 100% company-paid medical, dental, and vision coverage for employees and dependents, with HSA/HRA options.
• Flexible Time Off for exempt employees or accrued PTO of up to 25 days for non-exempt employees.
• 12 paid holidays.
• Parental leave and sick leave.
• Daily catered lunch and unlimited snacks for in-office employees.
• 401(k) retirement plan.
• Fitness reimbursement.
• Dog Fridays.
• Equity participation as part of total compensation.

What This Job Offers

• Job Type: Full-time
• Career Level: Mid Level
• Education Level: No Education Listed