Application Security Engineer – Software Vulnerability Remediation

CONCEPT SOLUTIONS LLC•Reston, VA

8d•$130,000 - $150,000•Hybrid

About The Position

Concept Solutions, LLC is seeking an Application Security Engineer to support a mission-critical application modernization program for a Department of War customer. The program is modernizing access across production applications through a unified platform with single sign-on, a common user interface, and a repeatable application integration approach, while maintaining and supporting existing systems. The engineer will strengthen application security by identifying and remediating vulnerabilities, supporting continuous monitoring, and collaborating with software development teams on secure coding practices. The role supports security improvements while helping ensure the continued operation and sustainment of mission-critical federal applications. The position is hybrid, based around the Reston, Virginia headquarters and approved remote locations in the United States. On-site work at Government facilities in Northern Virginia and Maryland is required as needed. The full-time schedule is 40 hours per week, Monday through Friday, with core hours from 9:00 a.m. to 3:00 p.m. Eastern. Work is organized into two-week sprints, each ending with a customer demonstration. Travel is 0–10% within the Washington, DC metropolitan area. Government-furnished equipment is used for access to Government environments. U.S. citizenship and an active Secret clearance or higher are specified in the posting.

Requirements

At least 4 years of experience in application security, secure software engineering, or a closely related discipline.
Hands-on experience identifying and remediating security vulnerabilities in Java or Go (Golang) applications.
Experience addressing security findings within production software environments.
Active Secret security clearance.
U.S. citizenship.

Nice To Haves

Experience using software vulnerability scanning tools such as Syft, Grype, or similar technologies.
Familiarity with Security Technical Implementation Guides (STIGs).

Responsibilities

Identify and remediate security findings across existing production applications, including dependency vulnerabilities, container vulnerabilities, STIG compliance issues, and code-level findings from security scans and assessments.
Maintain accurate and current Plans of Action and Milestones (POA&Ms) for the application portfolio, tracking security findings and remediation progress.
Collaborate with the Information System Security Engineer (ISSE) to develop and maintain application security evidence supporting continuous monitoring requirements.
Partner with software development squads to implement secure coding fixes and address vulnerabilities in application codebases.
Support ongoing application security improvements while ensuring the continued operation and sustainment of production applications.