Senior Application Security Engineer

True Anomaly • Denver, CO

21h • Onsite

About The Position

True Anomaly is hiring a Senior Application Security Engineer to implement and audit security controls for mission-critical space systems subject to stringent government compliance requirements. The role works across security engineering, NIST 800-171 and NIST 800-53 compliance frameworks, and cloud-native architectures to help ensure satellite mission control software and flight systems meet Department of Defense security standards. The engineer will design and implement application-level controls for audit logging, incident response, access control, and security monitoring, working closely with product engineering teams to integrate security into development. Candidates must be able to obtain and maintain a security clearance. Successful candidates must be located near Denver or Long Beach, and significant work is performed onsite. The position remains open until filled.

Requirements

• At least 5 years of experience in application security, product security, or security engineering.
• Hands-on experience implementing security controls for frameworks such as NIST 800-171, NIST 800-53, FedRAMP, or CMMC.
• Strong software engineering skills, including the ability to write production-quality code in at least one language such as Python, Rust, Elixir, or C++.
• Experience with cloud security; Azure is preferred, while AWS or GCP is acceptable.
• Understanding of secure architecture principles, including threat modeling and risk assessment; OAuth2, JWT, RBAC, and ABAC authentication and authorization patterns; cryptography and key management; and defense-in-depth and Zero Trust principles.
• Ability to collaborate with engineering teams to implement security controls without blocking development velocity.
• Eligibility for a DoD Secret or TS/SCI clearance; the position requires the ability to obtain and maintain a security clearance.
• U.S. citizenship, lawful permanent residence, protected-individual status as defined by 8 U.S.C. 1324b(a)(3), or eligibility to obtain required U.S. Department of State authorizations under U.S. Government space technology export regulations.
• Ability to be located near Denver or Long Beach, with significant work performed onsite.

Nice To Haves

• Active TS/SCI clearance or ability to obtain and maintain a security clearance.
• Direct experience implementing NIST 800-171 Rev 3 or NIST 800-53, including gap analysis, control implementation, and evidence collection.
• Experience with Department of Defense Impact Levels (IL2, IL4, IL5, or IL6) or STIGs.
• Familiarity with Elixir, Erlang, Phoenix, or other functional programming ecosystems such as Scala, Haskell, F#, or OCaml.
• Experience with Azure Government Cloud or other FedRAMP-authorized cloud environments.
• Experience using the Ghommit tool.
• Background in DevSecOps or Platform Security Engineering, including GitOps workflows, CI/CD security, Infrastructure as Code security (Terraform, Bicep, or Pulumi), or Kubernetes security (Pod Security Standards, network policies, or service mesh).
• Experience with security incident response, detection engineering, and SOAR integration.
• Familiarity with aerospace, defense, or other highly regulated industries such as finance, healthcare, or critical infrastructure.
• Previous startup or fast-paced environment experience, including building processes from scratch.

Responsibilities

• Create security architecture documentation and operational security guides for government authorization processes.
• Drive a vulnerability management program with remediation SLAs of 30, 90, or 180 days based on severity.
• Perform security code reviews for Elixir, Python, C++, and JavaScript codebases.
• Collaborate in the triage and management of security automation tools, including SAST, SCA, and DAST tools.
• Work with engineering teams to address security findings and implement secure coding practices.
• Develop and deliver security training for software engineers and systems administrators across the organization.
• Create and manage incident response playbooks for application security events.
• Evaluate and integrate third-party security solutions to improve security capabilities.

Benefits

• 100% company-paid medical, dental, and vision coverage for employees and dependents, with HSA/HRA options.
• Flexible Time Off for exempt employees or accrued PTO of up to 25 days for non-exempt employees.
• 12 paid holidays.
• Parental leave and sick leave.
• Daily catered lunch and unlimited snacks for in-office employees.
• 401(k) retirement plan.
• Fitness reimbursement.
• Dog Fridays.
• Equity participation as part of total compensation.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior
• Education Level: No Education Listed