Cybersecurity Engineer​/Software Security

Data Systems Analysts, Inc. is seeking a TS/SCI-cleared Cybersecurity Engineer focused on application and software security at an onsite NGIC role in Washington, DC (Charlottesville, VA). The position supports DoD mission systems by testing and improving application security, translating security requirements into technical solutions, and documenting evidence for RMF and ATO activities.

• Location: Washington, DC (onsite)
• Security Clearance: TS/SCI

• Salary: USD 140,000 to 170,000 per year

• Own software security within the cyber engineering team, providing technical guidance to secure applications, APIs, and back-end services
  .
• Conduct security testing of applications and validate that fixes address identified findings.
• Review source code against secure coding standards to identify vulnerabilities, insecure design, and exploitable weaknesses.
• Implement, tune, and maintain software security tools such as SAST, DAST, dependency scanning, and container scanning
  , and integrate them into development and release processes.
• Evaluate open-source and commercial cyber tools and source code to determine suitability, security risk, and what can be adapted for mission requirements.
• Partner with engineers, system admins, architects, ISSOs, and ISSMs to define security requirements and confirm tools and controls are sufficient.
• Assess risk associated with major software changes, unpatched components, and software reaching end of support.
• Apply adversary techniques (including MITRE ATT&CK
  ) and threat modeling to prioritize findings based on real-world impact.
• Document independent test results, release risk, and technical evidence supporting RMF and ATO activities.
• Communicate software risks, findings, and practical fixes to technical teams, system owners, and leadership.

• Minimum 5 years of combined experience in software development, application security, penetration testing, or secure software assessment.
• Hands-on software development experience in at least one language:
  Python, Java, C#, Go, or Java Script , with understanding of back-end services, APIs, and databases.
• Demonstrated ability to find and validate software vulnerabilities through code review
  , security testing
  , or technical assessment.
• Working knowledge of OWASP Top 10 and CWE
  , including how weaknesses are exploited and how to remediate them.
• Ability to assess exploitability and impact and communicate practical fixes to engineers and compliance staff.
• Ability to work independently as the primary software security resource on a cybersecurity team.

• Education: BS degree in Computer Science, Software Engineering, Computer Information Systems, Cybersecurity, or related field
• Substitution: Experience may be substituted for degree
• Clearance: TS/SCI Clearance
• Certification: CompTIA Security+ (DoD 8140 compliant)

• GWAPT, OSCP, OSWE, CSSLP, Pen Test+, CySA+, SecurityX/CASP+, CEH, or CISSP, or other relevant certification.
• Experience with SAST/DAST tools such as Fortify, Sonar Qube, Checkmarx, Burp Suite, or OWASP ZAP
  .
• Penetration testing, red team, or web application testing experience.
• Experience integrating security checks into CI/CD pipelines using Git Lab and/or Jenkins.
• Experience with SQL and relational databases (Oracle, PostgreSQL) and ETL workflows.
• Familiarity with containers, AWS/Gov Cloud, software supply chain security, or SBOMs.
• Familiarity with RMF
  , NIST SP 800-53
  , eMASS, and the DISA Application Security and Development STIG.
• Experience supporting DoD, U.S. Army, or Intelligence Community missions.

• Microsoft Copilot
• Programming:
  Python, Java, C#, Go, Java Script
• Security testing: SAST, DAST
• Standards and frameworks: OWASP Top 10, CWE, MITRE ATT&CK, RMF, ATO, NIST SP 800-53, eMASS, DISA Application Security and Development STIG
• Tools:
  Fortify, Sonar Qube, Checkmarx, Burp Suite, OWASP ZAP, Git Lab, Jenkins
• Databases and data: SQL, Oracle, PostgreSQL, ETL
• Cloud and supply chain:
  Containers, AWS/Gov Cloud, SBOMs
• Additional references (as listed):
  CompTIA Security+, GWAPT, OSCP, OSWE, CSSLP, Pen Test+, CySA+, SecurityX/CASP+, CEH, CISSP