> Markdown version of [/jobs/ext/1227098-senior-soc-security-engineer](https://www.wearedevelopers.com/jobs/ext/1227098-senior-soc-security-engineer). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Senior Soc Security Engineer - **Company:** Software Guidance & Assistance Inc - **Location:** Rockville, MD, United States (Remote available) - **Experience:** Expert - **Salary:** $131,300.0 - $237,350.0 - **Contract:** Permanent contract - **Skills:** Kubernetes Security, Amazon Web Services, Application Layers, Microsoft Azure, Burp Suite, Cloud Computing, Cloud Computing Security, Cyber Security, Information Systems, DevOps, Digital Assets, Intrusion Detection and Prevention, Apache Maven, NuGet, Open Source Technology, Open Web Application Security, Package Management Systems, Systems Development Life Cycle, Secure Coding, Security Information and Event Management, Software Configuration Management, Software Engineering, SonarQube, Software Vulnerability Management, Google Cloud, Software Security, QRadar, Veracode, Information Technology, Npm(Software), Splunk, Devsecops, Static Application Security Testing, Vulnerability Analysis, Dynamic Application Security Testing - **Published:** July 10, 2026 - **Apply:** https://www.careerjet.com/job/usdb9282a4bf20d810bfc4709f3b7e399f/eaa ## About the Role * Bachelor's or master's degree in computer science, Cybersecurity, Information Systems, or a related technical field * Equivalent experience may be considered in lieu of formal education for exceptional candidates * 7+ years of experience in SOC operations and incident response * Desired Certifications such as CISSP, CASE, OSCP, CSSLP, or GIAC * SIEM & EDR Tools: Proficiency with platforms like Splunk, Sentinel, QRadar, CrowdStrike * Deep understanding of SSCS attack vectors (dependency confusion, compromised packages, malicious commits, backdoors) * Strong knowledge of package managers (npm, PyPI, Maven, NuGet, etc.) and their security implications * Hands-on experience with artifact repository management tools * Application Security Tools: Experience with SAST, DAST, and SCA tools (e.g., Veracode, Burp Suite, SonarQube) * Secure Coding Practices: Deep understanding of OWASP Top 10, SANS 25, and remediation techniques * Cloud Security: Familiarity with AWS, Azure, or GCP security configurations and container security * Proficiency with software composition analysis (SCA) tools and vulnerability reachability concepts * Familiarity with cloud platforms (AWS, Azure, GCP) and container security * Experience integrating security into CI/CD pipelines * Familiarity with DevSecOps principles * Strong analytical thinking and attention to detail * Excellent communication skills for cross-functional collaboration * Ability to mentor junior analysts and lead incident response efforts ## Description Software Guidance & Assistance, Inc., (SGA), is searching for a Senior Soc Security Engineer for a CONTRACT assignment with one of our premier Regulatory clients. This position is fully remote. We are seeking a highly skilled Senior SOC Security Engineer with expertise in Application Security to join our dynamic cybersecurity team. This role requires flexibility to support our 24x7x365 Security Operations Center, including regular off-hours coverage. This role is for Shift 3 (11pm-8am). This role blends real-time threat detection and response with proactive application security strategies to protect our digital assets and infrastructure. As a senior member of the SOC, you will lead incident response efforts, mentor junior analysts, and collaborate with development teams to embed security into the software development lifecycle (SDLC). You'll be instrumental in shaping our security posture across both operational and application layers. Responsibilities : * Design and implement security controls for third-party software dependencies and open-source components * Monitor, detect, and respond to security incidents * Develop and execute vulnerability management strategies with emphasis on exploitability and reachability analysis * Conduct deep-dive investigations into Software supply chain Security (SSCS) threats, compromised dependencies, and malicious packages * Perform threat hunting for emerging attack vectors * Assess and mitigate risks associated with software dependencies across enterprise systems and applications * Lead incident response efforts for identity-based attacks and supply chain compromises * Develop detection use cases and threat models specific to SSCS attack vectors * Establish security practices for evaluating and vetting third-party packages and libraries * Collaborate with DevOps and engineering teams to integrate security into CI/CD pipelines * Perform vulnerability analysis on 3rd party CVE's with in the FINRA context and work with engineering teams to fix the vulnerability. ## Related Videos - [Our journey with Spring Boot in a microservice architecture](https://www.wearedevelopers.com/videos/511-our-journey-with-spring-boot-in-a-microservice-architecture) - [How your .NET software supply chain is open to attack : and how to fix it](https://www.wearedevelopers.com/videos/938-how-your-net-software-supply-chain-is-open-to-attack-and-how-to-fix-it) - [Security Pitfalls for Software Engineers](https://www.wearedevelopers.com/videos/726-security-pitfalls-for-software-engineers) - [Machine Learning in ML.NET](https://www.wearedevelopers.com/videos/272-machine-learning-in-ml-net) - [You can’t hack what you can’t see](https://www.wearedevelopers.com/videos/41-you-can-t-hack-what-you-can-t-see) - [C# 9 Source Generators - let the machine do the programming](https://www.wearedevelopers.com/videos/192-c-9-source-generators-let-the-machine-do-the-programming) ## Related Articles - [9 Ways to Make Money Hacking](https://www.wearedevelopers.com/magazine/333-9-ways-to-make-money-hacking) - [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed) - [Understanding and Mitigating Common Web Vulnerabilities](https://www.wearedevelopers.com/magazine/565-understanding-and-mitigating-common-web-vulnerabilities) - [Is Software Engineering Over-Saturated?](https://www.wearedevelopers.com/magazine/418-is-software-engineering-over-saturated) - [What’s the Difference between a Junior, Mid, and Senior Developer?](https://www.wearedevelopers.com/magazine/238-what-s-the-difference-between-a-junior-mid-and-senior-developer) - [Dev Digest 134 - Where pixels sing?](https://www.wearedevelopers.com/magazine/477-dev-digest-134-where-pixels-sing)