Software Secuirty Engineer - TS​/SCI Clearance

Description

We are seeking a cleared Software Security Engineer with a strong software engineering background and practical knowledge of U.S. government cybersecurity requirements. This hands‑on role will review source code, application designs, and software security testing results to assess whether applications meet applicable government security criteria. The engineer will translate security requirements into actionable development guidance, work directly with developers to remediate vulnerabilities, and document evidence supporting security assessments and release decisions.

This position emphasizes application security and code‑level analysis rather than primarily policy administration or network security operations.

• Perform manual security reviews of source code, pull requests, and application changes to identify vulnerabilities, insecure coding patterns, and deviations from approved security requirements.
• Assess application security against the program’s approved security baseline, including applicable NIST SP 800-53 controls, NIST Secure Software Development Framework (SP 800-218) practices, agency‑specific requirements, and DISA Application Security and Development STIG requirements where required by the customer.
• Translate applicable controls and security requirements into code review checklists, testable acceptance criteria, and developer implementation guidance.
• Review authentication, authorization, input validation, session management, error handling, audit logging, secrets management, data protection, and cryptographic implementation for secure design and coding practices.
• Execute and interpret static application security testing (SAST), dynamic application security testing (DAST), software composition analysis (SCA), and secrets scanning; validate findings and distinguish actionable vulnerabilities from false positives.
• Evaluate third‑party and open‑source dependencies for known vulnerabilities and support software component inventory and software bill of materials (SBOM) activities.
• Partner with developers to recommend practical code‑level fixes, review remediation changes, and verify closure through retesting and regression testing.
• Participate in threat modeling and application architecture reviews to identify security risks early in the software development life cycle.
• Integrate automated security checks and defined security gates into continuous integration and continuous delivery (CI/CD) workflows.
• Document findings with affected code locations, technical impact, applicable requirements, remediation recommendations, and verification evidence.
• Support Risk Management Framework (RMF) assessments and authorization to operate (ATO) activities by providing application security evidence and remediation status to security and compliance stakeholders.
• Communicate unresolved risks and release‑readiness recommendations to designated decision‑makers; elevate exceptions through the approved risk acceptance process.
• Help maintain secure coding standards and provide developers with practical guidance to prevent recurring vulnerabilities.

• Active TS/SCI Clearance
• Professional software engineering experience developing, testing, debugging, and maintaining production applications, with demonstrated hands‑on secure code review or application security experience.
• Proficiency in one or more programming languages relevant to the application environment, such as Java, C/C# , Python, JavaScript/Type Script, C/C++, or Go, and the ability to understand unfamiliar codebases.
• Working knowledge of government security requirements and the ability to apply relevant NIST SP 800-53 controls and NIST SSDF practices to software development and…