[Hiring] Staff Application Security Engineer @The AES Group

Role Description

One of our clients in the defense technology industry is seeking a Staff Application Security Engineer to build and advance a scalable, developer-focused application security program. This role will establish company-wide Secure Software Development Lifecycle (SDLC) policies, integrate security controls into engineering workflows, and strengthen application and software supply-chain security. The successful candidate will combine hands-on application security expertise with technical leadership to help engineering teams develop, test, build, and release secure software efficiently.

Key Responsibilities

• Establish and continuously improve secure SDLC policies, standards, procedures, and control requirements.
• Assess application security maturity across development teams, source-code repositories, CI/CD pipelines, build systems, and release processes.
• Implement and optimize SAST, DAST, SCA, secrets detection, infrastructure-as-code scanning, and container security tools.
• Partner with developers to identify, prioritize, remediate, and validate application security vulnerabilities.
• Lead threat modeling, secure design reviews, architecture assessments, and security requirements definition.
• Develop risk-based vulnerability management processes, remediation SLAs, exception handling, and risk acceptance procedures.
• Strengthen software supply-chain security through SBOMs, dependency verification, build provenance, artifact signing, and release attestations.
• Establish open-source governance practices covering dependency vulnerabilities, license compliance, component inventories, and approval workflows.
• Collaborate with DevOps and platform engineering to secure CI/CD pipelines, build environments, package registries, secrets, and deployment processes.
• Support vulnerability disclosure, CVE triage, security advisories, and product-security incident response.
• Develop a security champions program and provide secure-coding guidance, developer training, and security enablement.
• Create metrics and reports covering security risks, remediation performance, control coverage, SDLC adoption, and program maturity.
• Support customer assurance, audits, and regulatory compliance activities.

Qualifications

• 7+ years of experience in application security, product security, DevSecOps, secure software engineering, or a related cybersecurity field.
• Proven experience designing, implementing, or maturing an application security or secure SDLC program across multiple engineering teams.
• Hands-on experience with SAST, DAST, SCA, secrets scanning, and dependency vulnerability management.
• Experience integrating security controls into source control, CI/CD, build, release, and deployment workflows.
• Strong knowledge of secure coding, API security, authentication, authorization, injection vulnerabilities, insecure deserialization, and business-logic vulnerabilities.
• Experience with threat modeling, security architecture reviews, and risk-based vulnerability management.
• Knowledge of SBOMs, software provenance, artifact signing, build integrity, release attestations, and open-source software governance.
• Familiarity with NIST SP 800-218 (SSDF), OWASP SAMM, SLSA, or comparable frameworks.
• Ability to review production code and scripts in at least one modern programming language.
• Strong communication skills and the ability to explain technical risks to developers, leadership, auditors, and nontechnical stakeholders.

Preferred Qualifications

• Experience implementing SLSA-aligned controls, signed attestations, hardened build systems, and release integrity practices.
• Familiarity with SPDX, CycloneDX, VEX, or CSAF.
• Experience securing cloud-native applications, containers, Kubernetes, APIs, microservices, and infrastructure-as-code.
• Experience with tools such as Snyk, Checkmarx, Veracode, GitHub Advanced Security, GitLab Security, Semgrep, SonarQube, OWASP ZAP, Burp Suite, Mend, or Black Duck.
• Knowledge of NIST SP 800-171, NIST SP 800-53, CMMC, FedRAMP, ISO 27001, or SOC 2.
• Experience supporting defense, government, critical-infrastructure, or other high-assurance environments.
• Relevant certifications such as CSSLP, CISSP, OSWE, GIAC, or equivalent security credentials.