Application Security Engineer

Bespoke Technologies•Reston, VA

7h•Onsite

About The Position

Bespoke Technologies is seeking a highly experienced and motivated Application Security Engineer for a new contract. The role is part of a team of Data, Cloud, and Security engineers delivering a cloud-native, centralized platform that provides end-to-end budget traceability. The engineer will integrate security throughout the software development lifecycle and partner with developers and cloud engineers to design, build, assess, and sustain secure mission applications. The position is fully on-site in Reston, Virginia, and requires an active Poly clearance.

Requirements

Active Poly clearance; applicants without one will not be considered.
8+ years of relevant experience in application security, software engineering, DevSecOps, cybersecurity, or a related technical discipline.
Bachelor’s degree in engineering, computer science, or a related technical discipline.
Technical expertise and hands-on experience in application security, secure software development, software engineering, or DevSecOps.
Experience integrating security throughout the software development lifecycle, including secure design and architecture reviews, threat modeling, secure code review, security testing, vulnerability remediation, and release authorization support.
Experience developing or reviewing applications using Python, JavaScript frameworks, SQL, Shell scripting, PL/SQL, and other programming languages, with a strong understanding of common application vulnerabilities and secure coding practices.
Experience with SAST, DAST, SCA, secrets scanning, and container or infrastructure vulnerability scanning.
Experience building and securing cloud-native applications and services using Kubernetes, containers, Docker, REST APIs, and CI/CD pipelines.
Experience implementing DevSecOps practices, including automated security controls and testing within build and deployment pipelines.
Experience with cloud-native security services and controls; Oracle Cloud Infrastructure experience is desired.
Knowledge of security frameworks and standards such as NIST RMF, NIST Secure Software Development Framework, OWASP, DISA STIGs, and applicable federal security requirements.
Experience securing Oracle RDBMS environments, including database access controls, encryption, auditing, and secure handling of sensitive data.
Ability to assess, prioritize, document, and communicate application and cloud security risks, findings, and remediation recommendations to technical and non-technical stakeholders.
Experience working in an Agile framework.

Nice To Haves

Master’s degree.
Oracle Cloud Infrastructure IaaS and/or PaaS certifications.
Security certifications such as CISSP, CSSLP, Security+, GIAC, CEH, OSCP, or comparable credentials.
Experience implementing identity and access management, privileged access controls, secrets management, encryption, logging, monitoring, and incident response capabilities in cloud environments.
Experience with AI technologies for software development and securing AI-enabled applications or development workflows.
Data engineering experience, including securing data validations, business rules, data transformations, and sensitive-data handling.

Responsibilities

Integrate security throughout the software development lifecycle, including secure design and architecture reviews, threat modeling, secure code review, security testing, vulnerability remediation, and release authorization support.
Develop or review applications and apply secure coding practices across relevant programming languages and frameworks.
Use application security testing processes and tools, including SAST, DAST, SCA, secrets scanning, and container or infrastructure vulnerability scanning.
Build and secure cloud-native applications and services using Kubernetes, containers, Docker, REST APIs, and CI/CD pipelines.
Implement DevSecOps practices, including automated security controls and testing in build and deployment pipelines.
Assess, prioritize, document, and communicate application and cloud security risks, findings, and remediation recommendations to technical and non-technical stakeholders.
Secure Oracle RDBMS environments, including database access controls, encryption, auditing, and secure handling of sensitive data.
Work with developers and cloud engineers to address customer mission challenges and sustain secure mission applications.
Continuously learn and apply new security tools, techniques, and approaches to complex technical challenges.
Work within an Agile framework.