Application Security Engineer
Omaha, NE
No Clearance Required to Start
Must be able to Obtain a TS/SCI
The Defense Sector at Leidos is seeking a talented Application Security Engineer to join our dynamic Agile software teams in Omaha, Nebraska. This opportunity will provide professional growth that is singularly focused on providing world class solutions to our customers in an exciting, collaborative, and inclusive environment. You will be challenged and provided with a tremendous opportunity to expand your skills in a customer-facing, fast-paced, and rewarding environment.
In this role, the successful candidate has significant experience in building modern JavaScript-based web applications, including familiarity with multiple frameworks, strong programming fundamentals, and typical web application development and deployment processes, as well as cybersecurity experience. We’re looking for someone who can make risk-based security adjudication decisions, not simply operate vulnerability scanning tools! You must be capable of working on multiple projects at once and seeing them all through to completion, and a self-starter who is able to work through any obstacles to get the job done.
Most of the work will be on site in Leidos' facility in Omaha, Nebraska. Some level of remote/work from home is possible.
Primary Responsibilities:
Independently evaluate software dependencies, assess risk, approve or reject components, and document defensible technical decisions.
Apply your knowledge of SBOMs, transitive dependencies, component provenance, vulnerability intelligence, and artifact integrity in order to improve software supply chain security.
Evaluate vulnerabilities in the context of actual application use, rather than relying solely on automated scan results or CVSS scores.
Work directly with software engineers and DevSecOps teams to resolve security findings without unnecessarily impeding development velocity.
Use Jira, Confluence, Nexus, Git, development operations, collaboration, and source control tools.
Support creation and updating of all relevant documentation and specifications for design, development, and testing.
Basic Qualifications:
US Citizen with the ability to obtain and maintain a TS/SCI within 365 days of your start date with Leidos.
Bachelor’s degree with 4+ years of experience or a Master’s degree with 2+ years of experience. Additional experience may be considered in lieu of a degree.
Experience performing application security assessments, vulnerability analysis, and security risk evaluations across enterprise software applications and development environments.
Experience evaluating and adjudicating third-party software libraries, open-source components, and external dependencies for security vulnerabilities, licensing concerns, and software supply chain risks.
Working knowledge of Software Composition Analysis (SCA), Static Application Security Testing (SAST), and Dynamic Application Security Testing (DAST) methodologies and tools.
Experience analyzing Common Vulnerabilities and Exposures (CVEs), Common Vulnerability Scoring System (CVSS) scores, and vulnerability intelligence to assess applicability, exploitability, and operational risk.
Understanding secure software development lifecycle (SSDLC) practices, secure coding principles, and application security best practices.
Familiarity with software supply-chain security concepts, including dependency management, Software Bills of Materials (SBOMs), artifact integrity, and vulnerability remediation.
Experience collaborating with software development teams to identify, prioritize, document, and remediate application security findings.
Working knowledge of common application security risks and vulnerabilities, including the OWASP Top 10 and CWE classifications.
Ability to develop technical security assessments, document risk-based adjudication decisions, and communicate findings and recommendations to technical and program stakeholders.
Preferred…