APPLICATION INSTRUCTIONS:
CURRENT PENN STATE EMPLOYEE (faculty, staff, technical service, or student), please login to Workday to complete the internal application process . Please do not apply here, apply internally through Workday.
CURRENT PENN STATE STUDENT (not employed previously at the university) and seeking employment with Penn State, please login to Workday to complete the student application process. Please do not apply here, apply internally through Workday.
If you are NOT a current employee or student, please click “Apply” and complete the application process for external applicants .
Approval of remote and hybrid work is not guaranteed regardless of work location. For additional information on remote work at Penn State, see Notice to Out of State Applicants .
POSITION SPECIFICS
This position will be located fully onsite in San Diego, CA. Questions about flexible work arrangements may be directed to the hiring manager during the interview process.
Periodic travel to local and remote test sites is required.
We are seeking a highly skilled Application Security Engineer with a strong foundation in security engineering to join the DevSecOps Team of the Joint Mission Integration and Experimentation (JMIE) Division within the Information Advantage Office at the Applied Research Laboratory (ARL) at Penn State, based in San Diego, CA. The JMIE Division delivers advanced communications capabilities and secure experimentation networks supporting departmental mission partners, including cross‑domain data movement, tactical compute environments, and resilient edge processing strengthen secure software design, development, and deployment across our mission‑focused environments. In this role, you will champion application security best practices, embed security across the software development lifecycle, and work closely with engineering teams to ensure applications are resilient, compliant, and securely architected from concept to production.
ARL is an authorized DoD SkillBridge partner and welcomes all transitioning military members to apply.
You will:
Lead the integration of application security best practices into Agile and DevSecOps workflows, ensuring security requirements are included from initial design through deployment
Conduct deep‑dive secure code reviews, threat modeling, and architecture analysis to identify vulnerabilities and guide remediation strategies
Perform static (SAST), dynamic (DAST), and interactive application security testing, ensuring coverage across microservices, APIs, and containerized applications
Develop and maintain secure coding standards, patterns, and guidance used across engineering teams
Partner with developers and product owners to ensure secure design decisions, using approaches such as least privilege, secure defaults, zero‑trust principles, and defense‑in‑depth
Manage and optimize tools supporting application security, including SAST/DAST platforms, software composition analysis (SCA), secret‑scanning, and container/CI pipeline security tool
Evaluate open‑source and third‑party components for vulnerabilities, license risks, and supply chain integrity
Guide teams in secure API development, authentication/authorization best practices, cryptographic use, and secure data handling
Validate security controls and perform risk analysis for applications undergoing release, modernization, or cloud migration
Assist in building a security‑focused engineering culture through training, documentation, and hands‑on developer engagement
Collaborate with cybersecurity, cloud, and network teams to ensure application security aligns with enterprise risk, RMF requirements, and overall mission objectives
Additional responsibilities for senior-level roles may include:
Leading threat modeling sessions, red/blue–team collaboration, and advanced vulnerability analysis
Designing scalable AppSec programs and enterprise SDLC security strategies
Supporting RMF documentation and security artifacts relevant to…