Senior Cybersecurity Engineer, Applications

MESO SCALE DIAGNOSTICS, LLC.•Rockville, MD

4d•$101,400 - $154,650•Hybrid

About The Position

This position is part of the cybersecurity team and focuses primarily on improving application security across the organization. The engineer brings expertise in securing software, applications, and the environments in which they are built and deployed, while also contributing to the broader cybersecurity program and staying informed about current industry trends. The role includes responding to cybersecurity incidents, remediating application vulnerabilities, integrating security into software development and deployment pipelines, conducting threat modeling and secure design reviews, and representing security in architecture and change reviews. It also involves assessing application hosting environments, including AWS workloads and containerized platforms; coordinating external application penetration testing; developing and maintaining security tools and procedures; evaluating security technologies; and tracking and improving security metrics and posture. The position is performed in a traditional office environment, with the option for occasional telework and occasional local travel among offices as needed. The annual base salary range is $101,400 to $154,650. Employees may also qualify for a discretionary or non-discretionary bonus. Benefits include medical, dental, vision, and prescription coverage; a 401(k) plan with company matching; flexible spending accounts; disability and life insurance; paid vacation, sick leave, holidays, and parental leave; and other voluntary perks.

Requirements

Bachelor’s degree in MIS, computer science, computer engineering, or a related field with a cybersecurity concentration, or an equivalent combination of education and relevant experience.
At least 5 years of relevant cybersecurity work experience, including demonstrated depth in application or software security.
Knowledge of secure coding best practices and frameworks, software supply chain risk, dependency management, and artifact repository controls.
Working knowledge of OWASP resources, including the Top 10 and Application Security Verification Standard, and hands-on experience with static analysis, dynamic analysis, and software composition analysis tools.
Experience securing applications built on Java or .NET stacks, with familiarity with the development practices and common weaknesses of at least one required.
Knowledge of API security; authentication and authorization technologies including SSO, OAuth, OIDC, and SAML; and session management practices.
Working knowledge of Amazon Web Services and cloud security controls for application workloads, including container and Kubernetes security.
Knowledge of network, web server, and database security; web application firewall concepts; malware analysis; and incident response.
Understanding of data security, including classification, encryption, data loss prevention, and secrets management for credentials in code and pipelines.
Ability to create, maintain, and report metrics measuring the effectiveness of security controls.
Ability to take ownership of security initiatives and drive them to completion with minimal supervision; hands-on approach and ability to collaborate across teams.
Effective communication skills and a positive, confident attitude.
Excellent writing skills and the ability to create well-formatted reports and customer-facing documentation.

Nice To Haves

Life sciences experience.
Experience working in regulated or validated environments.
Industry certification such as GWAPT, GWEB, OSWE, CSSLP, OSCP, or CISSP.
Broader experience across other cybersecurity disciplines.
Familiarity with ISO 27001 or the NIST Cybersecurity Framework.
Scripting and automation skills in Bash, Python, PowerShell, or similar.

Responsibilities

Analyze, investigate, respond to, and recover from cybersecurity incidents, events, and threats according to the incident response lifecycle.
Remediate application vulnerabilities and guide engineering and development teams in taking preventative measures.
Integrate security into the software development lifecycle, including static analysis, dynamic analysis, and software composition analysis in build and deployment pipelines.
Conduct threat modeling and secure design reviews for new and existing applications, and provide recommendations to development and architecture teams.
Represent security in architecture design reviews and the Change Advisory Board to ensure security considerations are addressed before changes are approved.
Assess and improve the security of application hosting environments, including AWS workloads and containerized platforms.
Coordinate external application penetration testing and manage findings through remediation.
Engineer security solutions to mitigate risk and improve MSD’s security posture.
Assist with developing and maintaining security tools, techniques, and procedures for security testing, vulnerability detection, validation, and mitigation.
Evaluate best practices for commercial off-the-shelf and custom-developed applications.
Assist in evaluating and assessing security technologies to expand MSD’s cybersecurity portfolio.
Stay current on relevant application security and cloud industry updates through conferences, training, and events.
Contribute to continuous improvement of security posture and provide hands-on cybersecurity support as needed.
Collect, report, and continually enhance security metrics.
Monitor and maintain an understanding of the security posture of application development tools, technologies, and libraries.