Cybersecurity Engineer III (AppSec)

Sierra Nevada Corporation•Englewood, CO

17h

About The Position

The Cybersecurity Engineer III (AppSec) is a senior-level role responsible for designing, testing, and implementing secure operating systems, networks, and security monitoring tools. The position oversees IT security systems, manages incident responses, conducts risk assessments, develops security controls, and researches and integrates security tools and technologies. As part of SNC's corporate team, the role supports the company and its business areas with strategic direction and business support. The role focuses on application security analysis, secure design reviews, integrating security tooling into CI/CD workflows, and auditing scan tools and security gates against enterprise standards. The Engineer advises on AI-augmented application security and emerging AppSec capabilities, and partners with developers to foster secure practices while supporting innovation and business outcomes. The position requires the ability to obtain and maintain a Secret U.S. Security Clearance; U.S. citizenship is required. The estimated starting salary range is $131,010.00–$180,138.75, with compensation dependent on factors including skills, experience, education, training, certifications, and applicable geographic differentials. SNC offers medical, dental, and vision plans, a 401(k) match, life insurance, paid time off, tuition reimbursement, and other benefits. The position may be performed in an office or hybrid environment and may require travel.

Requirements

Bachelor's degree in Cybersecurity, Network Engineering, Information Technology, or a related Engineering field; relevant experience may substitute for the degree, with at least 9 years of related experience required in the absence of a degree.
At least 5 years of experience in a related role; a higher-level relevant degree may substitute for experience.
At least 3 years of experience focused on application security or DevOps/DevSecOps.
Strong understanding of cybersecurity principles for secure software design and the system development lifecycle, including identity and access management, secrets management, integration security, encryption and data handling, audit logging and monitoring, and supply chain security.
Demonstrated experience supporting the system development lifecycle, including planning, requirements, design, implementation, testing, deployment, and maintenance.
Hands-on experience configuring and integrating security tools and requirements into CI/CD workflows.
Hands-on experience analyzing source code and security tool outputs, evaluating exploitability and risk, and appropriately triaging findings.
Strong understanding of secure coding practices and DevSecOps principles.
Demonstrated ability to communicate and collaborate successfully with development teams as a trusted security partner.
Working knowledge of NIST SP 800-171, NIST SP 800-218, and OWASP standards.
Proven experience with security monitoring and assessment tools.
Experience supporting, troubleshooting, and administering networks, operating systems, and applications.
Advanced knowledge of data security administration principles, methods, and techniques.
Strong knowledge and experience administering current Microsoft platforms.
In-depth understanding of domain structures, user authentication, and digital signatures.
Ability to obtain and maintain a Secret U.S. Security Clearance; U.S. citizenship is required.
Ability to work in an office or hybrid environment, sit at a desk and work on a computer for prolonged periods, occasionally lift up to 20 pounds, and travel as needed.

Nice To Haves

Experience with SonarQube, Semgrep, Trivy, JFrog Xray, JFrog Artifactory, GitHub Actions, Terraform, or Ansible.
Proficiency in one or more programming languages such as C++, Python, or JavaScript.
Demonstrated experience designing and implementing Policy as Code.
Understanding of Infrastructure as Code and cloud-native application technologies, including Kubernetes, Docker, and API management.
Understanding of AI system security principles.
Demonstrated experience securing applications with AI components.

Responsibilities

Perform application security analysis using automated tools such as SAST, SCA, and DAST, as well as code reviews; help development teams understand, triage, and address vulnerabilities.
Review proposed designs for security controls and secure design, and work with developers to integrate security into system and application designs.
Work with DevOps engineers to integrate and maintain automated security tools and gates in CI/CD workflows.
Audit security scan tool and workflow security gate configurations for compliance with enterprise security standards, and support continuous improvement of tooling workflows.
Advise and support the business in implementing AI-augmented application security measures and other emerging AppSec improvements.
Serve as a trusted security partner and expert for developers, fostering a culture of security within development teams.
Collaborate with development teams to support secure innovation while protecting developer velocity and business outcomes.
Design, test, and implement secure operating systems, networks, and security monitoring tools.
Oversee IT security systems, manage incident responses, conduct risk assessments, and develop advanced security controls.
Research, recommend, and integrate security tools and technologies.
Support, troubleshoot, and administer networks, operating systems, and applications.