Application Security Engineer III

True Anomaly•Long Beach, CA

2d•$140,000 - $205,000•Onsite

About The Position

As an Application Security Engineer III at True Anomaly, you will implement and audit security controls for mission-critical space systems subject to stringent government compliance requirements. The role sits at the intersection of security engineering, NIST 800-171/800-53 compliance, and modern cloud-native architectures, supporting security standards for satellite mission control software and flight systems. You will design and implement application-level controls, including audit logging, incident response capabilities, access controls, and security monitoring. You will work closely with product engineering teams to integrate security into their work while helping maintain development velocity. This position requires the ability to obtain and maintain a security clearance. Successful candidates must be located near Denver or Long Beach, and significant work must be performed onsite. Candidates must also meet the stated U.S. Government space technology export authorization requirements.

Requirements

At least 3 years of experience in application security, product security, or security engineering.
Hands-on experience implementing security controls for compliance frameworks such as NIST 800-171, NIST 800-53, FedRAMP, or CMMC.
Strong software engineering skills, including the ability to write production-quality code in at least one language such as Python, Rust, Elixir, or C++.
Experience with cloud security; Azure is preferred, while AWS or GCP is acceptable.
Understanding of secure architecture principles, including threat modeling and risk assessment; authentication and authorization patterns such as OAuth2, JWT, RBAC, and ABAC; cryptography and key management; and defense-in-depth and Zero Trust principles.
Demonstrated ability to collaborate with engineering teams to implement security controls without blocking development velocity.
Eligible for a DoD Secret or TS/SCI clearance; the position requires the ability to obtain and maintain a security clearance.
Must be located near Denver or Long Beach; significant work must be performed onsite.
Must be a U.S. citizen, lawful permanent resident, protected individual under 8 U.S.C. 1324b(a)(3), or eligible to obtain required U.S. Department of State authorizations under applicable export regulations.

Nice To Haves

Active TS/SCI clearance or ability to obtain and maintain a security clearance.
Direct experience with NIST 800-171 Rev 3 or NIST 800-53 implementation projects, including gap analysis, control implementation, and evidence collection.
Experience with Department of Defense Impact Levels (IL2/IL4/IL5/IL6) or STIGs (Secure Technical Implementation Guides).
Familiarity with Elixir/Erlang/Phoenix or other functional programming ecosystems such as Scala, Haskell, F#, or OCaml.
Experience with Azure Government Cloud or other FedRAMP-authorized cloud environments.
Experience using the Ghommit tool.
Background in DevSecOps or Platform Security Engineering, including GitOps workflows and CI/CD security, Infrastructure as Code security using Terraform, Bicep, or Pulumi, and Kubernetes security.
Experience with security incident response, including detection engineering and SOAR integration.
Familiarity with aerospace, defense, or other highly regulated industries such as finance, healthcare, or critical infrastructure.
Previous experience in startups or fast-paced environments, including building processes from scratch.

Responsibilities

Create security architecture documentation and operational security guides for government authorization processes.
Drive the vulnerability management program, with remediation SLAs of 30, 90, or 180 days based on severity.
Perform security code reviews for Elixir, Python, C++, and JavaScript codebases.
Collaborate in triage and management of security automation using SAST tools such as CodeQL and Semgrep, SCA tools such as JFrog Xray, and DAST tools.
Collaborate with engineering teams to address security findings and implement secure coding practices.
Develop and deliver security training for software engineers and systems administrators across the organization.
Create and manage incident response playbooks specific to application security events.
Evaluate and integrate third-party security solutions to enhance security capabilities.

Benefits

100% company-paid medical, dental, and vision coverage for employees and dependents, with HSA/HRA options.
Flexible Time Off for exempt employees.
Accrued PTO of up to 25 days for non-exempt employees.
12 paid holidays.
Parental leave.
Sick leave.
Daily catered lunch and unlimited snacks for in-office employees.
401(k) retirement plan.
Fitness reimbursement.
Dog Fridays.
Equity participation as part of the total compensation package.