> Markdown version of [/jobs/ext/1447349-federal-vulnerability-mgmt-app-security-engineer-us-citizen](https://www.wearedevelopers.com/jobs/ext/1447349-federal-vulnerability-mgmt-app-security-engineer-us-citizen). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Federal Vulnerability Mgmt & App Security Engineer (US Citizen) - **Company:** PSI Services LLC - **Location:** Springfield, IL, United States (Remote available) - **Experience:** Experienced - **Salary:** $125,000.0 - **Contract:** Permanent contract - **Skills:** Data Analysis, Architectural Patterns, Cyber Security, Continuous Integration, DevOps, Open Web Application Security, Systems Development Life Cycle, Secure Coding, Session Management, Software Engineering, Software Vulnerability Management, Web Applications, Software Security, Cyber Threat Analysis, Tools for Reporting, Qualys, Static Application Security Testing, Vulnerability Analysis, Programming Languages, Dynamic Application Security Testing - **Published:** July 26, 2026 - **Apply:** https://dejobs.org/x/x/C82AB7ABD4C54B2EB408A5B00E3756E1/job/ ## About the Role * Strong understanding of information security risk measurement (qualitative and quantitative) to support effective prioritization. * Working knowledge of industry security frameworks and standards (e.g., NIST CSF/800-53, ISO 27001, OWASP). * Ability to correlate threat intelligence with vulnerability and application risk., * Solid understanding of secure application development , including common programming languages, frameworks, and architectural patterns. * Hands-on experience with Application Security testing methodologies , including: * Static Application Security Testing (SAST) * Dynamic Application Security Testing (DAST) * Software Composition Analysis (SCA) * Familiarity with OWASP Top 10 , API Security Top 10, and common application attack patterns. * Experience integrating security scanning tools into CI/CD pipelines . * Ability to perform threat modeling and design-level security assessments. * Strong understanding of authentication, authorization, session management, and data protection controls within applications. Vulnerability & Threat Management * Expertise in vulnerability management programs, including lifecycle management and remediation governance. * Experience with vulnerability scanning and reporting tools (e.g., Qualys, Tenable, CrowdStrike, or equivalent). * Familiarity with cyber threat intelligence services and the application of threat data to prioritization decisions. * Broad technical knowledge of networks, operating systems, cloud platforms, and web applications Education and Experience 3-5+ years of combined experience in cybersecurity, application security, or vulnerability management. * Prior experience working closely with software engineering or DevOps teams is strongly preferred. ## Description The Threat, Vulnerability & Application Security Analyst is a dual-focus security practitioner responsible for identifying, assessing, and reducing risk across infrastructure, cloud, and application environments. This role combines enterprise threat and vulnerability management with hands-on application security oversight across the software development lifecycle (SDLC). The analyst correlates threat intelligence, asset inventory, vulnerability data, and application risk to inform security priorities, guide remediation, and continuously improve the organization's security posture. A core responsibility is partnering closely with engineering, platform, and product teams to embed security earlier in development, reduce exploitable risk, and ensure compliance with internal security standards and external regulatory requirements. This role emphasizes automation, scalability, and pragmatism-driving measurable risk reduction through tooling, process improvements, and actionable security guidance. Success requires persistence, strong technical depth across AppSec and vulnerability domains, and the ability to translate risk into clear, prioritized actions for technical and non-technical stakeholders. Role Responsibilities * Drive continuous improvements in vulnerability management processes and tools by leveraging industry-leading technologies, automation, and data-driven insights. * Stay current on industry trends, emerging threats and best practices in vulnerability management and adapt the program accordingly. * Evaluate and recommend vulnerability management tools and technologies, ensuring the optimal balance of effectiveness and efficiency. * Develop and deliver regular metrics, reports, KPIs and presentations to executive leadership and key stakeholders, communicating the status and effectiveness of the vulnerability management program. * Assist in building a diverse vulnerability management program that covers secure software development lifecycle, patch governance, and application security. * Perform technical threat/risk and vulnerability assessments and manage vulnerabilities throughout their lifecycle. * Provide support and maintain tools required for the vulnerability management program. 1. Provide consultative support to operational teams on how to fix identified vulnerabilities. 2. Own and evolve the Application Security program, integrating findings into the broader vulnerability management lifecycle. * Perform and oversee application security assessments, including static (SAST), dynamic (DAST), software composition analysis (SCA), and manual secure code reviews where appropriate. * Partner with development and DevOps teams to embed security into the SDLC, including CI/CD pipeline integrations and secure design reviews. * Define and maintain application risk prioritization that considers exploitability, business impact, data sensitivity, and threat context. * Review application architectures and threat models to proactively identify design-level security weaknesses. * Establish and maintain secure coding standards aligned to OWASP Top 10 and industry best practices. * Triage, validate, and manage application vulnerabilities through remediation and verification. * Enable developer success through consultative AppSec support, clear remediation guidance, and security-by-design recommendations. ## Related Videos - [Security Pitfalls for Software Engineers](https://www.wearedevelopers.com/videos/726-security-pitfalls-for-software-engineers) - [Data Science in Retail](https://www.wearedevelopers.com/videos/586-data-science-in-retail) - [From DevOps to Scaled DevOps: How We’re Rebuilding Continuous Delivery as a Platform](https://www.wearedevelopers.com/videos/100018-from-devops-to-scaled-devops-how-we-re-rebuilding-continuous-delivery-as-a-platform) - [You can’t hack what you can’t see](https://www.wearedevelopers.com/videos/41-you-can-t-hack-what-you-can-t-see) - [Data Science on Software Data](https://www.wearedevelopers.com/videos/162-data-science-on-software-data) - [DevOps Maturity Check – a way to balance autonomy and alignment](https://www.wearedevelopers.com/videos/58-devops-maturity-check-a-way-to-balance-autonomy-and-alignment) ## Related Articles - [Understanding and Mitigating Common Web Vulnerabilities](https://www.wearedevelopers.com/magazine/565-understanding-and-mitigating-common-web-vulnerabilities) - [9 Ways to Make Money Hacking](https://www.wearedevelopers.com/magazine/333-9-ways-to-make-money-hacking) - [Walking Into The Era of Supply Chain Risks](https://www.wearedevelopers.com/magazine/106-walking-into-the-era-of-supply-chain-risks) - [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed) - [Dev Digest 134 - Where pixels sing?](https://www.wearedevelopers.com/magazine/477-dev-digest-134-where-pixels-sing) - [The Overflow: Security and Privacy](https://www.wearedevelopers.com/magazine/715-the-overflow-security-and-privacy)