Cyber Security Engineer; not infrastructure

Job Summary:

Application Cyber Security Engineer

• Develop and implement application security solutions, focusing on software security (not infrastructure).
• Support Dev Sec Ops , Dev Ops, AWS Cloud Security, and Cloud Migration initiatives.
• Architect, engineer, and administer secure systems and security technology.
• Assist in developing and deploying security plans aligned with organizational objectives.
• Advise management on cybersecurity policies, processes, and procedures.
• Provide engineering support and system administration for specialized cybersecurity solutions.
• Troubleshoot and resolve complex problems related to cybersecurity software installation, operation, and configuration.
• Identify and manage potential conflicts during cybersecurity solution implementation.
• Analyze system logs to detect performance and security anomalies.
• Collaborate with system architects and project managers to define security requirements.
• Conduct security testing using tools and techniques such as SAST, DAST, IAST, SCA, manual penetration testing, secure code review, and threat modeling.
• Ensure secure SDLC practices and manage application vulnerabilities.
• Secure cloud environments (especially AWS) and use cloud-native security platforms (e.g., Wiz, Crowd Strike).
• Apply expertise in Kubernetes and container security, including Amazon EKS, pod security, RBAC, and container hardening.
• Map security controls to frameworks (NIST, ISO 27001, SOC2, CIS Benchmarks, MITRE ATT&CK, etc.).
• Utilize CI/CD and Dev Ops tools to integrate security into pipelines, manage artifacts, and protect secrets.
• Work directly with development teams to explain security issues and recommend/validate fixes.
• Implement infrastructure-as-code and policy-as-code security using tools like Terraform, Helm, Cloud Formation, and Rego/OPA.
• Communicate technical risks and recommendations clearly to technical and non-technical stakeholders.
• Maintain or obtain one or more relevant security certifications (e.g., CISSP, CISM, CEH, CISA).
• Monthly onsite presence required in Reston, VA (hybrid role).
• Preferred:
  Experience with health insurance customers and AWS cloud security.
• Strong written and verbal communication skills required.