Application Security Engineer

Leidos • Omaha, NE

2d • $87,100 - $157,450 • Hybrid

About The Position

Leidos is seeking an Application Security Engineer to join its Defense Sector Agile software teams in Omaha, Nebraska. The role focuses on providing application and software supply-chain security in a collaborative, customer-facing, fast-paced environment. The successful candidate will have experience building modern JavaScript-based web applications, strong programming fundamentals, knowledge of web application development and deployment, and cybersecurity expertise. The position requires risk-based security adjudication—not merely operation of vulnerability scanning tools—and the ability to manage multiple projects through completion.

The engineer evaluates software components and vulnerabilities in the context of application use, makes and documents defensible risk decisions, and works with software engineers and DevSecOps teams to resolve security findings while supporting development velocity. The position also supports security documentation and specifications for design, development, and testing. Most work is onsite at Leidos' Omaha facility, with some remote or work-from-home possibility. No clearance is required to start, but the employee must be able to obtain and maintain a TS/SCI clearance within 365 days of starting.

Requirements

• Be a U.S. citizen and be able to obtain and maintain a TS/SCI clearance within 365 days of starting with Leidos.
• Bachelor’s degree and 4 or more years of experience, or a Master’s degree and 2 or more years of experience; additional experience may be considered in lieu of a degree.
• Experience performing application security assessments, vulnerability analysis, and security risk evaluations across enterprise software applications and development environments.
• Experience evaluating and adjudicating third-party software libraries, open-source components, and external dependencies for security vulnerabilities, licensing concerns, and software supply-chain risks.
• Working knowledge of Software Composition Analysis (SCA), Static Application Security Testing (SAST), and Dynamic Application Security Testing (DAST) methodologies and tools.
• Experience analyzing CVEs, CVSS scores, and vulnerability intelligence to assess applicability, exploitability, and operational risk.
• Understanding of secure software development lifecycle practices, secure coding principles, and application security best practices.
• Familiarity with software supply-chain security concepts, including dependency management, SBOMs, artifact integrity, and vulnerability remediation.
• Experience collaborating with software development teams to identify, prioritize, document, and remediate application security findings.
• Working knowledge of common application security risks and vulnerabilities, including the OWASP Top 10 and CWE classifications.
• Ability to develop technical security assessments, document risk-based adjudication decisions, and communicate findings and recommendations to technical and program stakeholders.
• Ability to work on multiple projects at once, follow them through to completion, and work independently through obstacles.

Nice To Haves

• Active TS/SCI security clearance.
• Experience supporting application security activities in DoD, Intelligence Community, or other highly regulated and security-sensitive software development environments.
• Experience with modern software development languages such as Java, Python, JavaScript, or Rust.
• Experience implementing or managing third-party library approval and adjudication processes, including assessment of component provenance, known vulnerabilities, transitive dependencies, licensing restrictions, and mitigation strategies.
• Hands-on experience with SCA and vulnerability management tools such as Sonatype Nexus IQ, JFrog Xray, Black Duck, Snyk, Mend, Dependency-Track, or equivalent platforms.
• Experience with application security testing tools such as Fortify, Checkmarx, Veracode, Semgrep, SonarQube, or equivalent technologies.
• Experience generating, analyzing, and maintaining SBOMs in formats such as CycloneDX and SPDX.
• Familiarity with software supply-chain security frameworks and guidance, including NIST SP 800-218 (SSDF), NIST SP 800-53, NIST SP 800-161, and relevant CISA guidance.
• Experience assessing vulnerability exploitability and prioritizing remediation using VEX, CISA Known Exploited Vulnerabilities (KEV), EPSS, and other threat intelligence sources.
• Experience integrating automated security scanning, dependency analysis, and compliance checks into CI/CD pipelines and DevSecOps workflows.
• Experience securing containerized applications, container images, and Kubernetes-based deployment environments.
• Understanding of software artifact repositories, package managers, and dependency ecosystems such as Maven, Gradle, npm, NuGet, PyPI, and Cargo.
• Experience evaluating software component provenance, artifact signing, integrity verification, and build-pipeline security using Sigstore, SLSA, or equivalent approaches.
• Ability to assess vulnerability findings in the context of application architecture, runtime behavior, and operational exposure to distinguish exploitable risks from false positives or non-applicable findings.
• Experience developing security policies, risk acceptance criteria, vulnerability exception processes, and documented mitigation strategies.
• Experience with Risk Management Framework (RMF), Authority to Operate (ATO) processes, and security control assessment activities.
• Experience scripting or automating security analysis workflows using Python, PowerShell, Bash, or similar technologies.
• Familiarity with secure development practices for Java, C/C++, Rust, JavaScript, or other enterprise programming languages.
• Relevant industry cybersecurity certifications such as CISSP, CSSLP, Security+, or GIAC GWEB.
• Experience with the USSTRATCOM Nuclear Planning process.

Responsibilities

• Independently evaluate software dependencies, assess risk, approve or reject components, and document defensible technical decisions.
• Apply knowledge of SBOMs, transitive dependencies, component provenance, vulnerability intelligence, and artifact integrity to improve software supply-chain security.
• Evaluate vulnerabilities in the context of actual application use rather than relying solely on automated scan results or CVSS scores.
• Work directly with software engineers and DevSecOps teams to resolve security findings without unnecessarily impeding development velocity.
• Use Jira, Confluence, Nexus, Git, development operations, collaboration, and source control tools.
• Support creation and updating of relevant documentation and specifications for design, development, and testing.

What This Job Offers

• Job Type: Full-time
• Career Level: Mid Level