Application Security Engineer

The Pennsylvania State University•San Diego, CA

5d•$119,736 - $197,604•Onsite

About The Position

Penn State's Applied Research Laboratory (ARL) is seeking an Application Security Engineer to join the DevSecOps Team of the Joint Mission Integration and Experimentation (JMIE) Division within the Information Advantage Office. The position is fully onsite in San Diego, California, with periodic travel to local and remote test sites. The JMIE Division provides advanced communications capabilities and secure experimentation networks for mission partners, including cross-domain data movement, tactical compute environments, and resilient edge processing. The engineer will strengthen secure software design, development, and deployment across mission-focused environments. The role champions application security practices, embeds security throughout the software development lifecycle, and partners with engineering teams to help ensure applications are resilient, compliant, and securely architected from concept through production. Additional responsibilities for senior-level roles may include leading advanced security collaboration and analysis, developing enterprise SDLC security strategies, supporting RMF documentation, and advising on high-visibility or mission-critical applications. ARL supports research and development for the Navy, the Intelligence Community, and other federal customers. Applicants must be U.S. citizens and have an active TS/SCI clearance. Employees must be eligible to obtain a government security clearance, participate in ARL's drug testing program, and comply with electronic and physical monitoring requirements. Employment requires successful completion of background checks. The role is covered by a salary range of $119,736 to $197,604, including an adjustment for the required geographic work location.

Requirements

Bachelor's degree.
At least 3 years of relevant experience, or an equivalent combination of education and experience.
Strong background in application security, secure development practices, vulnerability analysis, and secure design principles.
Experience with SAST, DAST, SCA, and CI/CD security integration.
Proficiency in secure coding techniques in one or more languages, such as Python, Java, C#, JavaScript/TypeScript, or Go.
Experience reviewing application architectures, microservices, and containerized workloads for security weaknesses.
Familiarity with NIST 800-53 or similar control frameworks as they apply to application-level security requirements.
Strong understanding of authentication, authorization, encryption, and API security best practices.
Background in cybersecurity disciplines, including vulnerability management, scanning, compliance evaluation, and control implementation.
Experience interpreting security policy, generating evidence, and documenting test results for NIST 800-53 / JSIG security controls.
Active TS/SCI clearance.
U.S. citizenship.
Must be eligible to obtain a government security clearance and comply with ARL drug testing and electronic and physical monitoring requirements.

Nice To Haves

Experience operating within DevSecOps pipelines and modern CI/CD ecosystems.
Knowledge of cloud-native application security in AWS, Azure, or DoD cloud environments.
Experience with secure design reviews for APIs, distributed systems, mobile applications, or cross-domain solutions.
Background with eMASS, STIGs, or ACAS in support of application accreditation efforts.
Relevant certifications such as CSSLP, GWAPT, GWEB, GCSA, GSSP, or CISSP.
Prior experience delivering developer security training or building secure coding programs.

Responsibilities

Integrate application security practices into Agile and DevSecOps workflows, ensuring security requirements are addressed from initial design through deployment.
Conduct secure code reviews, threat modeling, and architecture analysis; identify vulnerabilities and guide remediation.
Perform static (SAST), dynamic (DAST), and interactive application security testing across microservices, APIs, and containerized applications.
Develop and maintain secure coding standards, patterns, and guidance for engineering teams.
Partner with developers and product owners on secure design decisions, including least privilege, secure defaults, zero-trust principles, and defense in depth.
Manage and optimize application security tools, including SAST/DAST platforms, software composition analysis, secret scanning, and container and CI pipeline security tools.
Evaluate open-source and third-party components for vulnerabilities, license risks, and supply chain integrity.
Guide teams on secure API development, authentication and authorization, cryptographic use, and secure data handling.
Validate security controls and perform risk analysis for applications undergoing release, modernization, or cloud migration.
Promote a security-focused engineering culture through training, documentation, and hands-on engagement with developers.
Collaborate with cybersecurity, cloud, and network teams to align application security with enterprise risk, RMF requirements, and mission objectives.
For senior-level roles, potentially lead threat modeling sessions, red/blue-team collaboration, and advanced vulnerability analysis; design scalable AppSec programs and enterprise SDLC security strategies; support RMF documentation and application-level security artifacts; and advise on high-visibility or mission-critical applications.