> Markdown version of [/jobs/ext/2547568-web-developer-security-engineer-sma-4](https://www.wearedevelopers.com/jobs/ext/2547568-web-developer-security-engineer-sma-4). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Web Developer Security Engineer (SMA 4) - **Company:** E-Logic INC - **Location:** Washington, DC, United States - **Experience:** Experienced - **Contract:** Permanent contract - **Skills:** Kubernetes Security, Java (Programming Language), JavaScript (Programming Language), .NET Framework, Application Programming Interfaces (APIs), Amazon Web Services, Application Firewall, HTML5, C Sharp (Programming Language), Cascading Style Sheets (CSS), Cloud Computing Security, Cyber Security, Information Systems, Continuous Integration, DevOps, Web Servers, Windows Communication Foundation, Intrusion Detection Systems, Python (Programming Language), Model View Controller (MVC), Node.Js, Open Web Application Security, Systems Development Life Cycle, Standard Sql, Secure Coding, Web Application Security, Security Information and Event Management, Software Engineering, Wireshark, TypeScript, Web Applications, Scripting, Cloud Platform System, GitHub Copilot, ReactJS, Software Security, Kubernetes, Information Technology, Sentry, Web Technologies, Api Design, Restful APIs, Devsecops, Docker - **Published:** August 6, 2026 - **Apply:** https://www.indeed.com/viewjob?jk=9eda91c7922f3bd0 ## About the Role * Certifications: Must hold at least one certification from each of the following three categories: * Specialized AppSec: CSSLP, GWEB, or CASE * Offensive Security: OSWE or OSCP * Foundational Security: Security+ or GSEC * Certifications must have been maintained for a minimum of 5 years. Expired certifications or certifications never used professionally will not be considered. * Clearance: Must be eligible to obtain and maintain a Public Trust Tier 2 clearance (background check conducted through U.S. Capitol Police). * Experience: Minimum of 3 years of experience in Web Application Security, Application Security Engineering (AppSec), or secure software development life cycle (SSDLC). * Technical Proficiency: Demonstrated hands-on experience with: * Modern web technologies: .NET (C# MVC, WCF), HTML5, CSS3, JavaScript, REST APIs, and SQL * AI-assisted development tools (e.g., GitHub Copilot, OpenAI API/Codex) * Scripting languages (Python, JavaScript/Node.js, Java, React.js, TypeScript) * Web Application Firewalls (WAFs) and File Integrity Monitoring (FIM) solutions * Security testing tools (Wireshark, SIEM, IDS/IPS, NDR, EDR) * Security Knowledge: Strong understanding of OWASP Top 10, secure coding standards, and proactive mitigation of common web vulnerabilities. Desired Experience: * Bachelor's degree (or higher) in Computer Science, Cybersecurity, Information Systems, Engineering, or a related field. * In-depth experience with federal cybersecurity frameworks (NIST SP 800-53, FISMA, FedRAMP) authorization processes. * Proven background in threat modeling, risk assessment, and designing resilient security architecture. * Experience implementing secure DevOps/DevSecOps practices, specifically CI/CD pipeline and automating security gates. * Knowledge of cloud security (AWS) and container security (Docker, Kubernetes). Clearance Requirement: Must be eligible for a Public Trust Tier 2 ## Description We are looking for a highly skilled and proactive Web Developer Security Engineer to join our team supporting the Congressional Budget Office (CBO) under the SENTRY Blanket Purchase Agreement (BPA). As a Web Developer Security Engineer, you will play a pivotal role in protecting mission-critical web applications, APIs, and sensitive data. You will embed robust security principles throughout the software development lifecycle (SDLC) to build security as a proactive, foundational pillar. You will identify, analyze, and neutralize critical vulnerabilities, logic flaws, insecure dependencies, and misconfigurations, and drive the end-to-end vulnerability lifecycle., * Web Application Security: Identify, analyze, and neutralize critical vulnerabilities, logic flaws, insecure dependencies, and misconfigurations. * Vulnerability Lifecycle: Drive the end-to-end vulnerability lifecycle-integrating proactive threat modeling and advanced security assessments, ensuring remediation integrity through rigorous technical validation. * Secure Design: Support integration of security controls into application architectures, APIs, and supporting services; advise on secure design patterns, data protection mechanisms, and secure communication protocols. * Monitoring & Incident Response: Obtain, review, and analyze web server and application logs to detect anomalies and indicators of compromise; support the end-to-end response to web application security events. * Automation: Implement automation scripts for threat intelligence integration to optimize alert accuracy; leverage AI-assisted development tools (e.g., GitHub Copilot, OpenAI API/Codex) and scripting languages (Python, JavaScript/Node.js) to automate security monitoring and compliance audits. * Compliance: Ensure all web applications and cloud infrastructures comply with Federal cybersecurity frameworks, including NIST SP 800-53, FISMA, and FedRAMP (as applicable); participate in audits, risk assessments, and security authorization processes. ## Related Videos - [The Resilience of the World Wide Web](https://www.wearedevelopers.com/videos/1281-the-resilience-of-the-world-wide-web) - [Docker Compose: Rediscovered](https://www.wearedevelopers.com/videos/1978-docker-compose-rediscovered) - [From Doubt to Confidence: How Sentry Uses Verdaccio to Bulletproof SDK Releases](https://www.wearedevelopers.com/videos/739-from-doubt-to-confidence-how-sentry-uses-verdaccio-to-bulletproof-sdk-releases) - [Security Pitfalls for Software Engineers](https://www.wearedevelopers.com/videos/726-security-pitfalls-for-software-engineers) - [Debugging in the Dark](https://www.wearedevelopers.com/videos/1658-debugging-in-the-dark) - [Docker build without Docker](https://www.wearedevelopers.com/videos/100114-docker-build-without-docker) ## Related Articles - [Understanding and Mitigating Common Web Vulnerabilities](https://www.wearedevelopers.com/magazine/565-understanding-and-mitigating-common-web-vulnerabilities) - [Is Software Engineering Over-Saturated?](https://www.wearedevelopers.com/magazine/418-is-software-engineering-over-saturated) - [Dev Digest 134 - Where pixels sing?](https://www.wearedevelopers.com/magazine/477-dev-digest-134-where-pixels-sing) - [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed) - [9 Ways to Make Money Hacking](https://www.wearedevelopers.com/magazine/333-9-ways-to-make-money-hacking) - [Best Coding Boot Camps in Germany](https://www.wearedevelopers.com/magazine/237-best-coding-boot-camps-in-germany)