Staff Application Security Engineer

True Anomaly•Long Beach, CA

2h•$200,000 - $305,000•Onsite

About The Position

As a Staff Application Security Engineer, you will implement and audit security controls for mission-critical space systems subject to stringent government compliance requirements. The role brings together security engineering, compliance frameworks such as NIST 800-171 and NIST 800-53, and modern cloud-native architectures to help ensure satellite mission control software and flight systems meet Department of Defense security standards. You will design and implement application-level security controls, including audit logging, incident response capabilities, access controls, and security monitoring. You will work closely with product engineering teams to integrate security into development and support strong outcomes without unnecessarily slowing engineering velocity. The role calls for building security controls and processes from the ground up in a fast-paced environment. Candidates must be able to obtain and maintain a security clearance and must be located near Denver or Long Beach; significant work must be done on site.

Requirements

10 or more years of experience in application security, product security, or security engineering.
Hands-on experience implementing security controls for compliance frameworks such as NIST 800-171, NIST 800-53, FedRAMP, or CMMC.
Strong software engineering skills and ability to write production-quality code in at least one language such as Python, Rust, Elixir, or C++, or a similar language.
Experience with cloud security; Azure is preferred, while AWS or GCP is acceptable.
Understanding of threat modeling and risk assessment.
Understanding of authentication and authorization patterns, including OAuth2, JWT, RBAC, and ABAC.
Understanding of cryptography and key management.
Understanding of defense-in-depth and Zero Trust principles.
Proven ability to work collaboratively with engineering teams to implement security controls without blocking velocity.
Eligible for DoD Secret or TS/SCI clearance; the position requires the ability to obtain and maintain a security clearance.
U.S. citizen, lawful permanent resident, protected individual as defined by 8 U.S.C. 1324b(a)(3), or eligible to obtain required U.S. Department of State authorizations under ITAR.
Must be located near Denver or Long Beach; significant work must be done on site.

Nice To Haves

Active TS/SCI clearance or ability to obtain and maintain a security clearance.
Direct experience with NIST 800-171 Rev 3 or NIST 800-53 implementation projects, including gap analysis, control implementation, and evidence collection.
Experience with Department of Defense Impact Levels (IL2/IL4/IL5/IL6) or STIGs (Secure Technical Implementation Guides).
Familiarity with Elixir/Erlang/Phoenix or other functional programming ecosystems such as Scala, Haskell, F#, or OCaml.
Experience with Azure Government Cloud or other FedRAMP-authorized cloud environments.
Experience using the Ghommit tool.
Background in DevSecOps or Platform Security Engineering.
Experience with GitOps workflows and CI/CD security.
Experience with Infrastructure as Code security tools such as Terraform, Bicep, or Pulumi.
Experience with Kubernetes security, including Pod Security Standards, network policies, or service mesh.
Experience with security incident response, including detection engineering and SOAR integration.
Familiarity with aerospace, defense, or other highly regulated industries such as finance, healthcare, or critical infrastructure.
Previous experience in startups or fast-paced environments and ability to build processes from scratch.

Responsibilities

Create security architecture documentation and operational security guides for government authorization processes.
Drive a vulnerability management program with remediation SLAs of 30, 90, or 180 days depending on severity.
Perform security code reviews for Elixir, Python, C++, and JavaScript codebases.
Collaborate in triage and management of security automations using SAST tools such as CodeQL and Semgrep, SCA tools such as JFrog Xray, and DAST tools.
Collaborate with engineering teams to address security findings and implement secure coding practices.
Develop and deliver security training to software engineers and systems administrators across the organization.
Create and manage incident response playbooks for application security events.
Evaluate and integrate third-party security solutions to enhance security capabilities.
Design and implement application-level security controls, including audit logging, incident response capabilities, access controls, and security monitoring.

Benefits

100% company-paid medical, dental, and vision coverage for employees and dependents, with HSA/HRA options.
Flexible Time Off for exempt employees.
Accrued PTO of up to 25 days for non-exempt employees.
12 paid holidays.
Parental Leave.
Sick Leave.
Daily catered lunch and unlimited snacks for in-office employees.
401(k) retirement plan.
Fitness reimbursement.
Dog Fridays.
Equity participation as part of total compensation.