Cybersecurity Engineer III (AppSec)

Sierra Nevada Corporation•Arlington, VA

2d•$131,010 - $180,139

About The Position

The Cybersecurity Engineer III (AppSec) is a senior-level role on SNC’s corporate team. The position leads efforts to design, test, and implement secure operating systems, networks, and security monitoring tools. It oversees IT security systems, manages incident responses, conducts risk assessments, develops security controls, and researches, recommends, and integrates security tools and technologies. The corporate team provides strategic direction and business support across areas including executive management, finance and accounting, operations, human resources, legal, IT, information security, facilities, marketing, and communications. The role focuses on application security analysis, secure design reviews, and integrating security tools into DevOps and CI/CD workflows. It partners with development teams to assess and triage vulnerabilities, strengthen application and system designs, improve security tooling and workflows, support AI-augmented AppSec measures, and foster a culture of security while enabling development velocity and business outcomes. The position requires the ability to obtain and maintain a Secret U.S. Security Clearance; U.S. citizenship is required for the clearance. The position may be performed in an office or hybrid environment and may require travel as needed. Essential physical functions include prolonged sitting and computer work, and occasional lifting of up to 20 pounds.

Requirements

Bachelor's degree in Cybersecurity, Network Engineering, Information Technology, or a related engineering field; relevant experience may substitute for the education requirement, with at least 9 years of related experience required in the absence of a degree. A higher-level relevant degree may substitute for experience.
At least 5 years of experience in a related role.
At least 3 years of experience focused on application security or DevOps/DevSecOps.
Strong understanding of cybersecurity principles relevant to secure software design and the system development lifecycle, including identity and access management, secrets management, integration security, encryption and data handling, audit logging and monitoring, and supply chain security.
Demonstrated experience supporting the system development lifecycle, including planning, requirements, design, implementation, testing, deployment, and maintenance.
Hands-on experience configuring and integrating security tools and requirements into CI/CD workflows.
Hands-on experience analyzing source code and security tool outputs, evaluating exploitability and risk, and appropriately triaging findings.
Strong understanding of secure coding practices and DevSecOps principles.
Demonstrated ability to communicate and collaborate successfully with development teams as a trusted security partner.
Working knowledge of NIST SP 800-171, NIST SP 800-218, and OWASP standards.
Proven experience with security monitoring and assessment tools.
Experience supporting, troubleshooting, and administering a variety of networks, operating systems, and applications.
Advanced knowledge of data security administration principles, methods, and techniques.
Strong knowledge and experience administering a variety of current Microsoft platforms.
In-depth understanding of domain structures, user authentication, and digital signatures.
Ability to obtain and maintain a Secret U.S. Security Clearance; U.S. citizenship is required for the clearance.

Nice To Haves

Experience with SonarQube, Semgrep, Trivy, JFrog Xray, JFrog Artifactory, GitHub Actions, Terraform, or Ansible.
Proficiency in one or more programming languages such as C++, Python, or JavaScript.
Demonstrated experience designing and implementing Policy as Code.
Understanding of Infrastructure as Code and cloud-native application technologies, including Kubernetes, Docker, and API management.
Understanding of AI system security principles.
Demonstrated experience securing applications with AI components.

Responsibilities

Perform application security analysis using automated tools such as SAST, SCA, and DAST, as well as code reviews, to help development teams understand, triage, and treat vulnerabilities.
Review proposed designs for security controls and secure design, and work with developers to incorporate security into system and application designs.
Work with DevOps engineers to integrate and maintain automated security tooling and gates in CI/CD workflows.
Audit security scanning tools and workflow security gate configurations for adherence to enterprise security standards, and support continuous improvement of tooling workflows.
Advise and support the business in implementing AI-augmented application security measures and other emerging AppSec improvements.
Serve as a trusted security partner and expert for developers, fostering a culture of security within development teams.
Collaborate with development teams to support secure innovation while protecting developer velocity and business outcomes.
Lead efforts to design, test, and implement secure operating systems, networks, and security monitoring tools.
Oversee IT security systems, manage incident responses, conduct risk assessments, develop security controls, and research, recommend, and integrate security tools and technologies.
Support, troubleshoot, and administer networks, operating systems, and applications.