> Markdown version of [/jobs/ext/4170519-application-security-tools-engineer](https://www.wearedevelopers.com/jobs/ext/4170519-application-security-tools-engineer). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Application Security Tools Engineer

- **Company:** Mount Indie
- **Location:** San Diego, CA, United States
- **Experience:** Expert
- **Contract:** Permanent contract
- **Skills:** Kubernetes Security, Java (Programming Language), .NET Framework, JIRA, Burp Suite, Continuous Integration, Disaster Recovery, Gradle, Python (Programming Language), Lightweight Directory Access Protocols (LDAP), Linux System Administration, Apache Maven, Networking Basics, Cisco Nexus Switches, Node.Js, NuGet, OpenShift, Open Web Application Security, Systems Development Life Cycle, Red Hat Enterprise Linux, Fortify (Software), Secure Coding, Security Information and Event Management, Software Vulnerability Management, Backup and Restore, SSL Certificate Management, Transport Layer Security, System Availability, Sonatype, Software Security, Gitlab-ci, Kubernetes, Bug Reporting, Enterprise Integration, Build Tools, Npm(Software), Oracle Cloud Infrastructure, Splunk, Devsecops, Jenkins, Servicenow, Artifactory
- **Published:** October 31, 2026
- **Apply:** https://www.clearancejobs.com/jobs/9270428/application-security-tools-engineer

## About the Role

* 5+ years in application security engineering or DevSecOps in regulated environments
 * Hands on administration and pipeline integration with Sonatype, specifically Nexus IQ or Lifecycle
 * Hands on administration and pipeline integration with Fortify, SCA and SSC
 * Hands on administration and pipeline integration with StackRox or Red Hat Advanced Cluster Security
 * Hands on work with Burp Suite, Professional or Enterprise preferred
 * Strong CI/CD and automation skills, with repeatable integrations and policy gates
 * Secure SDLC, OWASP Top 10, dependency risk, SBOM concepts, container and Kubernetes security
 * Linux administration, networking fundamentals, TLS and certificate management, identity integration through SSO or LDAP
 * Common languages and build systems: Java with Maven or Gradle, .NET with NuGet, Node with npm, Python with pip
 * Oracle Cloud Infrastructure
 * Active DoD Secret clearance (U.S. citizenship required)
 * DoD 8570 IAT II certification, such as Security+

Preferred Qualifications

 * Oracle Cloud certifications
 * DoD or IC work with RMF, STIGs and vulnerability management processes
 * Registries and orchestration: Harbor, Artifactory, ECR, Kubernetes, OpenShift, Helm
 * Integration with SIEM, SOAR and ticketing tools such as Splunk, ServiceNow and Jira
 * Agile delivery with hands on Jira
 * CISSP, CSSLP, GIAC or a Kubernetes security certification

## Description

* Deploy, configure, harden and maintain Sonatype, Fortify, StackRox and Burp Suite in on premise and accredited cloud environments
 * Manage upgrades, plugins, licensing, capacity planning, backup and restore, high availability and disaster recovery
 * Establish SLAs and SLOs, monitoring and alerting, and operational runbooks
 * Integrate scanning tools into CI/CD pipelines such as Jenkins and GitLab CI with policy based gating and risk based exceptions
 * Standardize secure by default developer workflows: pull request checks, nightly scans, release readiness criteria
 * Build reusable templates and reference implementations for product teams
 * Define and tune scanning policies: severity thresholds, exploitability context, allowlists and denylists, quality gates
 * Reduce false positives and negatives through rule tuning, calibration and developer feedback loops
 * Maintain an auditable vulnerability management workflow covering triage, ownership, remediation SLAs and waiver documentation
 * Deliver findings with clear reproduction steps and secure coding guidance, then coordinate retesting and verify fixes
 * Implement image scanning, runtime detections, admission controls and Kubernetes policy enforcement in StackRox
 * Produce metrics and dashboards on vulnerability trends, time to remediate, pipeline pass rates and policy exceptions
 * Support RMF and ATO evidence needs with scan outputs, control mappings and procedures
 * Manage and mentor at least one other application security engineer
 * Perform tool assessments and present consolidation recommendations to senior executive leadership