> Markdown version of [/jobs/ext/2554093-application-security-engineer-full-scope-poly](https://www.wearedevelopers.com/jobs/ext/2554093-application-security-engineer-full-scope-poly). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Application Security Engineer (Full Scope Poly) - **Company:** Concept Plus - **Location:** Reston, VA, United States - **Experience:** Expert - **Contract:** Permanent contract - **Skills:** JavaScript (Programming Language), Agile Methodology, Artificial Intelligence, Cloud Computing, Cloud Computing Security, Cloud Engineering, Cyber Security, Continuous Integration, Information Engineering, Data Transformation, Database Connection, Infrastructure as a Service (IaaS), Identity and Access Management, Python (Programming Language), Key Management, Oracle Databases, Open Web Application Security, Platform as a Service (PAAS), Secure Coding, Security Software, Shell Script, Software Engineering, PL-SQL, SQL Databases, Systems Integration, Software Vulnerability Management, Data Logging, Data Processing, Cloud Platform System, Spring Cloud, Software Security, Build Management, Kubernetes, Information Technology, Restful APIs, Oracle Cloud Infrastructure, Devsecops, Docker, Static Application Security Testing, Vulnerability Analysis, Programming Languages, Dynamic Application Security Testing - **Published:** August 9, 2026 - **Apply:** https://www.indeed.com/viewjob?jk=dcdb5b7ecdc5622a ## About the Role * US Citizen * Must possess a TS/SCI security clearance with Polygraph. * Technical expertise and hands-on experience in application security, secure software development, software engineering, or DevSecOps, with the ability to apply these skills to Oracle Cloud and customer mission challenges. * Experience integrating security throughout the software development lifecycle, including secure design and architecture reviews, threat modeling, secure code review, security testing, vulnerability remediation, and release authorization support. * Experience developing or reviewing applications using Python, JavaScript frameworks, SQL, Shell scripting, PL/SQL, and other programming languages, with a strong understanding of common application vulnerabilities and secure coding practices. * Experience with application security testing tools and processes, including static application security testing (SAST), dynamic application security testing (DAST), software composition analysis (SCA), secrets scanning, and container or infrastructure vulnerability scanning. * Experience building and securing cloud-native applications and services using Kubernetes, containers, Docker, REST APIs, and CI/CD pipelines. * Experience implementing DevSecOps practices, including automated security controls and testing within build and deployment pipelines. * Experience with cloud-native security services and controls; Oracle Cloud Infrastructure (OCI) experience is desired. * Knowledge of security frameworks and standards such as NIST RMF, NIST Secure Software Development Framework, OWASP, DISA STIGs, and applicable federal security requirements. * Experience securing Oracle RDBMS environments, including database access controls, encryption, auditing, and secure handling of sensitive data. * Ability to assess, prioritize, document, and communicate application and cloud security risks, findings, and remediation recommendations to both technical and non-technical stakeholders. * Passion for technology, curiosity, and willingness to continuously learn new security tools, techniques, and approaches for solving complex technical challenges. * Experience working in an Agile framework. * 8+ years of relevant experience in application security, software engineering, DevSecOps, cybersecurity, or a related technical discipline. * Bachelor's Degree in engineering, computer science or related technical discipline. Master's degree preferred. Preferred Qualifications * Oracle Cloud Infrastructure (OCI) IaaS and/or PaaS certifications are preferred. * Security certifications such as CISSP, CSSLP, Security+, GIAC, CEH, OSCP, or comparable credentials. * Experience implementing identity and access management, privileged access controls, secrets management, encryption, logging, monitoring, and incident response capabilities in cloud environments. * Experience with AI technologies for software development and securing AI-enabled applications or development workflows. * Data engineering experience, including securing data validations, business rules, data transformations, and sensitive-data handling. ## Description Concept Plus is seeking a highly experienced and motivated Application Security Engineer for an exciting new contract. This role will be part of a team of Data, Cloud, and Security engineers delivering a cloud-native, centralized platform that provides end-to-end budget traceability. The Application Security Engineer will integrate security throughout the software development lifecycle, partnering with developers and cloud engineers to design, build, assess, and sustain secure mission applications. ## Related Videos - [Security Pitfalls for Software Engineers](https://www.wearedevelopers.com/videos/726-security-pitfalls-for-software-engineers) - [DevSecOps: Injecting Security into Mobile CI/CD Pipelines](https://www.wearedevelopers.com/videos/273-devsecops-injecting-security-into-mobile-ci-cd-pipelines) - [Docker Compose: Rediscovered](https://www.wearedevelopers.com/videos/1978-docker-compose-rediscovered) - [DevSecOps culture](https://www.wearedevelopers.com/videos/783-devsecops-culture) - [DevSecOps: Security in DevOps](https://www.wearedevelopers.com/videos/36-devsecops-security-in-devops) - [You can’t hack what you can’t see](https://www.wearedevelopers.com/videos/41-you-can-t-hack-what-you-can-t-see) ## Related Articles - [What Are The Top Skills Required For Azure Developers?](https://www.wearedevelopers.com/magazine/77-what-are-the-top-skills-required-for-azure-developers) - [Highest Paying Tech Companies for Developers](https://www.wearedevelopers.com/magazine/220-highest-paying-tech-companies-for-developers) - [7 Cloud Computing Trends Coming in 2025 for Developers](https://www.wearedevelopers.com/magazine/412-7-cloud-computing-trends-coming-in-2025-for-developers) - [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed) - [Best Paying Jobs in Technology](https://www.wearedevelopers.com/magazine/256-best-paying-jobs-in-technology) - [Is Software Engineering Over-Saturated?](https://www.wearedevelopers.com/magazine/418-is-software-engineering-over-saturated)