Application Security Engineer

SciTec•Boulder, CO

2d•$102,000 - $157,000

About The Position

SciTec, a Firefly Aerospace Company, is a non-traditional defense contractor supporting U.S. National Security and Defense. The Application Security Engineer will help secure mission-critical software systems by identifying, analyzing, and mitigating application-level vulnerabilities. The role emphasizes hands-on security analysis, security tooling integration, and partnering with software engineers to embed security throughout the development lifecycle in a DevSecOps environment. The engineer will support programs delivering Next-Generation Missile Warning software and work with a fast-paced team processing Overhead Persistent InfraRed (OPIR) sensor data for Missile Warning, Missile Defense, Battlespace Awareness, and Technical Intelligence. SciTec works exclusively on U.S. government contracts requiring all employees to be U.S. citizens. Applicants must be able to qualify for and maintain a DoD or DoE Secret security clearance and meet DoD 8140.01 Cyberspace Workforce Management requirements within six months of hire.

Requirements

Bachelor’s degree plus 2+ years of professional experience in cybersecurity or software development, or equivalent experience.
2+ years of experience focused on application/software security.
Experience analyzing source code for security flaws.
Familiarity with secure software development practices.
Strong analytical and problem-solving skills.
Strong written and verbal communication skills and attention to detail.
Ability to qualify for and maintain a DoD or DoE Secret security clearance.
Ability to meet DoD 8140.01 Cyberspace Workforce Management requirements within six months of hire.
U.S. citizenship, required because the company exclusively works on U.S. government contracts requiring it.

Nice To Haves

Active DoD Secret clearance or higher.
Experience identifying, exploiting, and remediating application vulnerabilities.
Published CVEs.
Proficiency in one or more programming languages such as C++, Python, JavaScript, or Rust.
Experience configuring and operating static analysis tools such as Coverity, Klocwork, or SonarQube.
Experience configuring and operating software composition analysis tools such as Snyk, Sonatype, Anchore, or JFrog Xray.
Experience with fuzzing frameworks such as AFL, AFL++, honggfuzz, or similar.
Experience with debugging, runtime instrumentation, or reverse engineering, including strace, eBPF, Ghidra, or IDA Pro.
Familiarity with threat modeling methodologies and frameworks such as MITRE ATT&CK.
Experience working in DevSecOps or Agile development environments.

Responsibilities

Perform application security analysis using automated and manual techniques, including static code analysis (SAST), software composition analysis (SCA), fuzzing, and manual code and design reviews.
Identify, analyze, and help remediate application vulnerabilities.
Support software engineers in integrating security considerations into system and application designs.
Integrate and maintain application security tooling within CI/CD and DevSecOps pipelines.
Design, implement, and improve continuous integration security analysis tooling.
Tune and maintain security tools to reduce false positives and improve signal quality.
Assist development teams in understanding findings and implementing effective fixes.
Support threat modeling and secure design reviews.
Stay current with emerging vulnerabilities, attack techniques, and mitigation strategies.
Document findings, recommendations, and best practices.
Perform other duties as assigned.