Software Secuirty Engineer - TS/SCI Clearance

CDW•Washington, DC

2d•$190,000 - $230,000

About The Position

CDW is seeking a cleared Software Security Engineer with a strong software engineering background and practical knowledge of U.S. government cybersecurity requirements. This hands-on application security role reviews source code, application designs, and software security testing results to assess whether applications meet applicable government security criteria. The engineer translates security requirements into actionable development guidance, works directly with developers to remediate vulnerabilities, and documents evidence for security assessments and release decisions. The position emphasizes application security and code-level analysis rather than primarily policy administration or network security operations. The role applies relevant NIST SP 800-53 controls, NIST Secure Software Development Framework (SP 800-218) practices, agency-specific requirements, and DISA Application Security and Development STIG requirements where required. It supports secure development throughout the software development life cycle, including code review, application testing, threat modeling, CI/CD security checks, RMF assessments, and ATO activities. The position requires an active TS/SCI clearance and professional software engineering experience with hands-on secure code review or application security experience. A bachelor’s degree in a related discipline or equivalent practical experience is required. The listed pay range is $190,000–$230,000, depending on experience and skill set; salary ranges may be subject to geographic differentials. Benefits information is provided through CDW’s benefits overview link.

Requirements

Active TS/SCI clearance.
Professional software engineering experience developing, testing, debugging, and maintaining production applications, with demonstrated hands-on secure code review or application security experience.
Proficiency in one or more programming languages relevant to the application environment, such as Java, C#, Python, JavaScript/TypeScript, C/C++, or Go, and ability to understand unfamiliar codebases.
Working knowledge of government security requirements and ability to apply relevant NIST SP 800-53 controls and NIST SSDF practices to software development and verification.
Ability to interpret customer-specific security requirements and, where applicable, DISA STIG checks, and translate them into concrete code changes and validation steps.
Strong understanding of common application vulnerabilities, including injection, broken access control, insecure authentication, insecure deserialization, and sensitive data exposure.
Experience using application security testing tools, validating results through code analysis, and explaining remediation options to developers.
Experience with Git-based version control, peer code review, automated testing, and CI/CD workflows.
Understanding of web application and API security, least privilege, secure handling of credentials, and protection of data in transit and at rest.
Ability to produce clear technical findings and maintain traceability between security requirements, implementation, testing, and remediation evidence.
Bachelor’s degree in Computer Science, Software Engineering, Cybersecurity, or a related discipline, or equivalent practical experience.

Nice To Haves

Experience supporting federal civilian or defense software programs, including application security reviews within RMF or ATO processes.
Hands-on experience applying the DISA Application Security and Development STIG and preparing supporting assessment evidence.
Experience with tools such as Fortify, Checkmarx, CodeQL, Veracode, SonarQube, Snyk, OWASP ZAP, or comparable application security platforms.
Experience with cloud-native applications, containers, infrastructure as code, and software supply chain security.
Familiarity with OWASP ASVS, OWASP Top 10, CWE, and risk-based vulnerability prioritization.
Relevant secure software development or application security certifications, such as CSSLP or an equivalent credential.

Responsibilities

Perform manual security reviews of source code, pull requests, and application changes to identify vulnerabilities, insecure coding patterns, and deviations from approved security requirements.
Assess application security against the program’s approved security baseline, including applicable NIST SP 800-53 controls, NIST SSDF practices, agency-specific requirements, and DISA Application Security and Development STIG requirements where required.
Translate security requirements into code review checklists, testable acceptance criteria, and developer implementation guidance.
Review authentication, authorization, input validation, session management, error handling, audit logging, secrets management, data protection, and cryptographic implementation for secure design and coding practices.
Execute and interpret SAST, DAST, SCA, and secrets scanning; validate findings and distinguish actionable vulnerabilities from false positives.
Evaluate third-party and open-source dependencies for known vulnerabilities and support software component inventory and SBOM activities.
Partner with developers to recommend code-level fixes, review remediation changes, and verify closure through retesting and regression testing.
Participate in threat modeling and application architecture reviews to identify security risks early in the software development life cycle.
Integrate automated security checks and defined security gates into CI/CD workflows.
Document findings with affected code locations, technical impact, applicable requirements, remediation recommendations, and verification evidence.
Support RMF assessments and ATO activities by providing application security evidence and remediation status to security and compliance stakeholders.
Communicate unresolved risks and release-readiness recommendations to designated decision-makers and escalate exceptions through the approved risk acceptance process.
Help maintain secure coding standards and provide developers with practical guidance to prevent recurring vulnerabilities.