Application Security Engineer – Ground Software

Firefly Aerospace

About The Position

As an Application Security Engineer at Firefly Aerospace, you will safeguard mission-critical software systems that enable spacecraft operations from the ground. The role combines full-stack engineering expertise with security practices to help ensure ground software and space assets remain resilient against threats. You will design, implement, and enforce security policies, conduct vulnerability assessments, and integrate secure development practices across web applications, backend services, databases, and cloud infrastructure. You will collaborate with engineering, IT, operations, and DevOps teams to incorporate security controls throughout the software lifecycle and support the security of Firefly missions.

Requirements

Bachelor’s degree in Computer Science, Software Engineering, Cybersecurity, or a related technical field.
At least 5 years of software engineering experience focused on application security.
Proficiency in modern programming frameworks, including React, Node.js, and Python.
Hands-on experience with vulnerability scanning and application security testing tools such as SonarQube, Snyk, Fortify, Veracode, or OWASP ZAP.
Strong understanding of secure coding practices, including OWASP Top 10 and CWE Top 25.
Knowledge of government and national security standards such as NIST 800-53, DoD STIGs, and FIPS 140-3.
Experience with container and cloud security, including Docker, Kubernetes, AWS IAM, and secrets management.
Familiarity with CI/CD security integration.
Strong understanding of authentication and authorization, and ability to apply encryption correctly using vetted libraries, TLS, and appropriate secrets handling.
Experience working in high-reliability, safety-critical, or regulated environments.

Nice To Haves

Advanced degree or equivalent hands-on experience in a related technical field.
Experience deploying software to classified or government systems.
Prior involvement in achieving or maintaining an Authority to Operate (ATO).
Background in mission-critical or aerospace ground systems.
Hands-on experience supporting incident response from the remediation side, including root-cause analysis, coordinating fixes, and hardening.
Active security clearance (Secret or higher) or eligibility to obtain one.
Security certifications such as CISSP, CSSLP, CEH, or GIAC.

Responsibilities

Design, implement, and maintain security controls for spacecraft ground software systems across front-end, back-end, databases, and cloud services.
Perform software scanning, code reviews, and vulnerability assessments using industry-standard tools and processes.
Define and enforce secure coding practices across development teams.
Integrate static and dynamic application security testing (SAST/DAST) into CI/CD pipelines.
Collaborate with developers to remediate vulnerabilities and design secure architectures.
Translate and implement government and national software security standards, including NIST and DoD STIGs.
Architect and maintain identity and access management (IAM), role-based access controls, and secure API authentication.
Work with DevOps to deploy hardened software in containerized and cloud environments.
Support audits, security reviews, and Authority to Operate (ATO) processes for classified and mission-critical systems.