Application Security Engineer
DecisionPoint | Cortek•,
•Remote
About The Position
DecisionPoint seeks an Application Security Engineer to perform advanced application-layer security assessments, secure coding reviews, vulnerability analysis, and security integration for enterprise applications supporting a federal and DoD-aligned mission environment. This role ensures secure development practices across CMS components, APIs, integrations, CI/CD pipelines, and custom code. The Application Security Engineer supports secure coding standards, threat modeling, static and dynamic testing, and secure secrets management. This position plays a critical role in strengthening application-level defenses, reducing vulnerabilities, and ensuring mission systems meet stringent DoD security requirements. This position is fully remote.
Requirements
- Must hold an active Top Secret clearance, supported by a Tier 5 background investigation.
- Bachelor’s degree in Computer Science, Cybersecurity, Engineering, or a related technical field.
- Minimum 7 years of experience in application security engineering, secure software development, or cybersecurity.
- Experience conducting code reviews, application penetration testing, or API security testing.
- Experience with static and dynamic testing tools, dependency scanning, and software composition analysis.
- Experience supporting secure CI/CD pipeline integration and DevSecOps practices.
- Experience implementing secure secrets management, encryption, and authentication protections.
- Strong understanding of OWASP Top 10, secure coding principles, and application-layer attack vectors.
- Experience with SAST/DAST tools, dependency scanners, and code review workflows.
- Knowledge of API security, token-based authentication, and secure data handling.
- Familiarity with CMS structures, template security, and module-level risk considerations.
- Understanding of identity and access management, certificate management, and secure authentication flows.
- Security+ or CISSP or CCSP certification.
- Strong analytical and problem-solving skills for identifying and remediating application-layer vulnerabilities.
- Ability to clearly communicate technical risks, secure coding guidance, and remediation recommendations.
- Strong attention to detail when reviewing code, configurations, and test results.
- Ability to work collaboratively with developers, cloud engineers, PMO staff, and mission stakeholders.
- Commitment to integrating security early and continuously throughout the development lifecycle.
Nice To Haves
- Experience with AWS cloud-native application security tools.
- Familiarity with container security, Kubernetes workload protections, and microservices security.
- Experience with modern CI/CD platforms and DevSecOps automation.
- AWS Security Specialty certification.
- GIAC secure coding or cloud security certifications.
- Certified Ethical Hacker (CEH) certification.
Responsibilities
- Conduct secure code reviews, focusing on application logic, API endpoints, CMS modules, and backend integrations.
- Perform API security assessments to validate authentication, authorization, data handling, and boundary protections.
- Support CMS hardening by reviewing templates, modules, configurations, and custom components for secure implementation.
- Integrate security requirements into CI/CD pipelines including SAST/DAST tools, dependency scanning, and automated controls.
- Manage secrets handling, encryption policies, and secure storage of API keys, tokens, and credentials.
- Conduct static and dynamic application security testing, vulnerability assessments, and remediation validation.
- Provide secure coding guidance to developers, architects, and product teams.
- Work with DevSecOps and cloud engineers to ensure secure build and deployment patterns.
- Perform threat modeling and recommend mitigations for high-risk application features.
- Review and validate authentication flows, SSO integrations, and identity-related protections.
- Assist with security documentation including test results, remediation plans, and secure configuration records.
- Support continuous monitoring, log analysis, and triage of application-layer security alerts.
- Participate in sprint teams, code review cycles, and architecture discussions to embed security early.
Benefits
- Equal Employment Opportunity and Affirmative Action employer
- Pay Transparency Policy
Stand Out From the Crowd
Upload your resume and get instant feedback on how well it matches this job.
Upload and Match Resume
What This Job Offers
Job Type
Full-time
Career Level
Senior
