Staff Application Security Engineer (R5949)
Core
Build and advance a scalable, developer-centered application security program, establishing company-wide secure SDLC policies and partnering with engineering teams to improve secure development and software supply-chain maturity.
Role type
Staff individual-contributor application security engineer
Builds
Secure software development lifecycle (SDLC) policies, secure CI/CD pipelines, and software supply-chain security practices
Domain
Defense technology, secure software engineering, DevSecOps
Required skills
Application security program leadership, secure SDLC policy design, SAST/DAST/SCA tooling, threat modeling, software supply-chain security (SBOM, VEX, SLSA), open-source governance, CI/CD pipeline security, vulnerability management, secure coding practices, risk-based vulnerability management, executive reporting
Preferred skills
SLSA implementation, VEX/CSAF/SBOM formats (SPDX/CycloneDX), cloud-native security (Kubernetes, microservices), infrastructure-as-code security
Technologies
SAST, DAST, SCA, SBOM, VEX, SLSA, SPDX, CycloneDX, Kubernetes, CI/CD pipelines
Responsibilities
Establish and improve company-wide secure SDLC policies and standards; translate security policy into engineering requirements; assess and improve CI/CD pipelines and build environments; implement application security tooling (SAST, DAST, SCA, secrets scanning); lead threat modeling and secure design reviews; manage software supply-chain security (SBOM, artifact signing, provenance); develop security champions program; create executive-ready metrics on program maturity
Seniority
Staff, hands-on IC with significant influence across engineering and leadership
