Application Security Tools Engineer

• Deploy, configure, harden and maintain Sonatype, Fortify, StackRox and Burp Suite in on premise and accredited cloud environments
• Manage upgrades, plugins, licensing, capacity planning, backup and restore, high availability and disaster recovery
• Establish SLAs and SLOs, monitoring and alerting, and operational runbooks
• Integrate scanning tools into CI/CD pipelines such as Jenkins and GitLab CI with policy based gating and risk based exceptions
• Standardize secure by default developer workflows: pull request checks, nightly scans, release readiness criteria
• Build reusable templates and reference implementations for product teams
• Define and tune scanning policies: severity thresholds, exploitability context, allowlists and denylists, quality gates
• Reduce false positives and negatives through rule tuning, calibration and developer feedback loops
• Maintain an auditable vulnerability management workflow covering triage, ownership, remediation SLAs and waiver documentation
• Deliver findings with clear reproduction steps and secure coding guidance, then coordinate retesting and verify fixes
• Implement image scanning, runtime detections, admission controls and Kubernetes policy enforcement in StackRox
• Produce metrics and dashboards on vulnerability trends, time to remediate, pipeline pass rates and policy exceptions
• Support RMF and ATO evidence needs with scan outputs, control mappings and procedures
• Manage and mentor at least one other application security engineer
• Perform tool assessments and present consolidation recommendations to senior executive leadership

• 5+ years in application security engineering or DevSecOps in regulated environments
• Hands on administration and pipeline integration with Sonatype, specifically Nexus IQ or Lifecycle
• Hands on administration and pipeline integration with Fortify, SCA and SSC
• Hands on administration and pipeline integration with StackRox or Red Hat Advanced Cluster Security
• Hands on work with Burp Suite, Professional or Enterprise preferred
• Strong CI/CD and automation skills, with repeatable integrations and policy gates
• Secure SDLC, OWASP Top 10, dependency risk, SBOM concepts, container and Kubernetes security
• Linux administration, networking fundamentals, TLS and certificate management, identity integration through SSO or LDAP
• Common languages and build systems: Java with Maven or Gradle, .NET with NuGet, Node with npm, Python with pip
• Oracle Cloud Infrastructure
• Active DoD Secret clearance (U.S. citizenship required)
• DoD 8570 IAT II certification, such as Security+

Preferred Qualifications

• Oracle Cloud certifications
• DoD or IC work with RMF, STIGs and vulnerability management processes
• Registries and orchestration: Harbor, Artifactory, ECR, Kubernetes, OpenShift, Helm
• Integration with SIEM, SOAR and ticketing tools such as Splunk, ServiceNow and Jira
• Agile delivery with hands on Jira
• CISSP, CSSLP, GIAC or a Kubernetes security certification