Senior Application Security Engineer

True Anomaly • Long Beach, CA

1d • $180,000 - $255,000 • Onsite

About The Position

True Anomaly is hiring a Senior Application Security Engineer to implement and audit security controls for mission-critical space systems subject to stringent government compliance requirements. The role works across security engineering, NIST 800-171/800-53 compliance, and cloud-native architectures to help ensure satellite mission control software and flight systems meet Department of Defense security standards. The engineer will design and implement application-level controls, including audit logging, incident response capabilities, access controls, and security monitoring, working with product engineering teams to integrate security into development. Candidates must be able to obtain and maintain a security clearance. Successful candidates must be located near Denver or Long Beach, and significant work is performed onsite. U.S. government space technology export regulations apply; applicants must meet the stated U.S. citizenship, residency, protected-individual, or authorization eligibility requirements.

Requirements

• At least 5 years of experience in application security, product security, or security engineering.
• Hands-on experience implementing security controls for compliance frameworks such as NIST 800-171, NIST 800-53, FedRAMP, or CMMC.
• Strong software engineering skills, including the ability to write production-quality code in at least one language such as Python, Rust, Elixir, or C++.
• Experience with cloud security; Azure is preferred, with AWS or GCP acceptable.
• Understanding of threat modeling and risk assessment.
• Understanding of authentication and authorization patterns, including OAuth2, JWT, RBAC, and ABAC.
• Understanding of cryptography and key management.
• Understanding of defense-in-depth and Zero Trust principles.
• Ability to work collaboratively with engineering teams to implement security controls without blocking development velocity.
• Eligible for DoD Secret or TS/SCI clearance.
• Ability to obtain and maintain a security clearance.
• Must meet U.S. government space technology export regulation eligibility requirements: U.S. citizen, lawful permanent resident, protected individual as defined by 8 U.S.C. 1324b(a)(3), or eligible to obtain required U.S. Department of State authorizations.
• Must be located near Denver or Long Beach; significant work must be performed onsite.

Nice To Haves

• Active TS/SCI clearance.
• Direct experience with NIST 800-171 Rev 3 or NIST 800-53 implementation projects, including gap analysis, control implementation, and evidence collection.
• Experience with Department of Defense Impact Levels (IL2/IL4/IL5/IL6) or STIGs.
• Familiarity with Elixir/Erlang/Phoenix or other functional programming ecosystems such as Scala, Haskell, F#, or OCaml.
• Experience with Azure Government Cloud or other FedRAMP-authorized cloud environments.
• Experience using the Ghommit tool.
• Background in DevSecOps or Platform Security Engineering, including GitOps workflows and CI/CD security.
• Experience with Infrastructure as Code security tools or practices, including Terraform, Bicep, or Pulumi.
• Kubernetes security experience, including Pod Security Standards, network policies, or service mesh.
• Experience with security incident response, detection engineering, or SOAR integration.
• Familiarity with aerospace, defense, or other highly regulated industries such as finance, healthcare, or critical infrastructure.
• Previous experience in startups or fast-paced environments, including building processes from scratch.

Responsibilities

• Create security architecture documentation and operational security guides for government authorization processes.
• Drive a vulnerability management program with remediation SLAs of 30, 90, or 180 days based on severity.
• Perform security code reviews for Elixir, Python, C++, and JavaScript codebases.
• Collaborate in the triage and management of security automation using SAST tools such as CodeQL and Semgrep, SCA tools such as JFrog Xray, and DAST tools.
• Work with engineering teams to address security findings and implement secure coding practices.
• Develop and deliver security training for software engineers and systems administrators across the organization.
• Create and manage incident response playbooks for application security events.
• Evaluate and integrate third-party security solutions to enhance security capabilities.

Benefits

• 100% company-paid medical, dental, and vision coverage for employees and dependents, with HSA/HRA options.
• Flexible Time Off for exempt employees or accrued PTO of up to 25 days for non-exempt employees.
• 12 paid holidays.
• Parental leave.
• Sick leave.
• Daily catered lunch and unlimited snacks for in-office employees.
• 401(k) retirement plan.
• Fitness reimbursement.
• Dog Fridays.
• Equity participation as part of total compensation.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior
• Education Level: No Education Listed