Sr. IT Application Security Engineer; USC

Career Developers Inc., a distinguished staffing and consulting firm, is proud to celebrate 30 years of service excellence. As a GSA Contract holder, we offer comprehensive staffing solutions for both commercial and government sectors nationwide. By selectively partnering with clients who share our values, we ensure productive collaborations that set us apart in the industry. Our dedication to candidates involves managing expectations with precision through business intelligence, thorough interview preparation, transparent communication, and exceptional feedback throughout the process.

We are committed to advancing your career and look forward to supporting your professional growth.

Department:
Information Technology

Reports to:

Director, Information Security

Location:

Hybrid/Reston, VA - 3 days on-site in the office per week (Tues/Wed)

Salary: 150-180K + 7% Bonus

• 6–8 years of Application Security experience designing, implementing, and operating security controls within enterprise application environments.

• Hands-on BIG-IP WAF administration experience
  , including building WAF policies, configuring protections, tuning rules/policies, troubleshooting issues, reducing false positives, and maintaining WAF controls in a production environment.

• Hands‑on container image security/scanning experience
  , including reviewing scan results, evaluating vulnerabilities, determining risk and remediation priorities, and working directly with development teams to resolve findings.

• Experience with a container security/scanning platform.
  The specific tool is not critical
  ; experience with platforms such as Prisma Cloud, Wiz, Snyk, or comparable technologies is relevant.

• Strong web application security knowledge, including OWASP Top 10 vulnerabilities and practical application of security controls.

• Experience conducting web application security scans, vulnerability assessments, and/or penetration testing.

• Experience partnering directly with Development and Dev Ops teams to integrate security into the SDLC and CI/CD pipelines.

• Experience with authentication and authorization technologies such as OAuth and OpenID
  .

• Strong troubleshooting and communication skills, with the ability to explain security risks and remediation requirements to both technical teams and senior IT stakeholders.

• Administer and enhance enterprise BIG-IP WAF capabilities, including building security policies, tuning rules, investigating false positives, troubleshooting application traffic issues, and maintaining effective web application protections.

• Design, implement, and operate application security controls across enterprise applications and supporting platforms.

• Perform container image security scanning and analyze vulnerabilities identified within application and container images.

• Assess the severity and business risk of container vulnerabilities and partner directly with development teams to prioritize and remediate findings.

• Work closely with Development and Dev Ops teams to embed security controls into the SDLC and CI/CD pipelines
  .

• Design and operate web application and API security protections, including policy configuration, rule tuning, automation, and ongoing improvement.

• Identify application security vulnerabilities, conduct risk assessments, and recommend practical mitigation and remediation strategies.

• Develop and maintain application security policies, standards, procedures, and controls.

• Develop security monitoring and telemetry for the application stack to improve proactive detection.

• Conduct technical investigations related to application security incidents and vulnerabilities.

• Support container security activities including image scanning, vulnerability risk…