Senior Application Security Engineer - Fortify, Sonatype, StackRox - Active Secret

• Deploy, configure, harden, and maintain Sonatype, Fortify, StackRox, and Burp Suite in on-premises and accredited cloud environments, including Oracle Cloud Infrastructure (OCI)
• Manage upgrades, plugins, licensing, capacity planning, backup and restore, high availability, and disaster recovery, and establish SLAs/SLOs, monitoring, alerting, and operational runbooks
• Integrate scanning tools into CI/CD pipelines such as Jenkins and GitLab CI, with policy-based gating and risk-based exceptions
• Standardize secure-by-default developer workflows, including pull request checks, nightly scans, and release readiness criteria, and build reusable templates and reference implementations for product teams
• Define and tune scanning policies, including severity thresholds, exploitability context, allowlists and denylists, and quality gates, and reduce false positives and negatives through rule tuning and developer feedback
• Maintain an auditable vulnerability management workflow covering triage, ownership, remediation SLAs, and exception and waiver documentation
• Deliver actionable findings with reproduction steps and secure coding guidance, partner with engineering teams on remediation, and verify fixes, including targeted Burp Suite validation for high-risk applications and APIs
• Implement StackRox image scanning, runtime detections, admission controls, and Kubernetes policy enforcement, and operationalize detections and response playbooks with SOC and incident response teams
• Produce metrics and dashboards on vulnerability trends, time to remediate, pipeline pass rates, and policy exceptions, and support RMF/ATO evidence with scan outputs, control mappings, and procedures
• Perform tool assessments and present recommendations to senior executive leaders, and lead and mentor at least one other AppSec professional within an Agile, Jira-based delivery model

• Active Secret security clearance and a current CompTIA Security+ certification or another certification satisfying the customer’s DoD 8570 IAT Level II requirement
• Five or more years of application security engineering or DevSecOps experience in regulated environments
• Hands-on administration and pipeline integration experience with Sonatype (Nexus IQ/Lifecycle), Fortify (SCA/SSC), StackRox/Red Hat ACS, and Burp Suite (Professional or Enterprise preferred)
• Strong CI/CD and automation skills, with the ability to build repeatable integrations and policy gates
• Working knowledge of secure SDLC practices, OWASP Top 10, dependency risk, SBOM concepts, and container and Kubernetes security
• Linux administration, networking fundamentals, TLS and certificate management, and identity integration (SSO/LDAP)
• Familiarity with common languages and build systems, such as Java/Maven/Gradle, .NET/NuGet, Node/npm, and Python/pip
• Working knowledge of Oracle Cloud Infrastructure (OCI)
• Strong communication skills, including the ability to brief senior leaders and guide other engineers, * Oracle Cloud Infrastructure experience or certifications (strongly preferred)
• Department of Defense or Intelligence Community experience with RMF, STIGs, and vulnerability management processes
• Experience with registries and orchestration platforms, such as Harbor, Artifactory, ECR, Kubernetes, OpenShift, and Helm
• Experience integrating security tools with SIEM/SOAR and ticketing platforms, such as Splunk, ServiceNow, and Jira
• Hands-on Jira experience supporting Agile project management
• One or more additional certifications, such as CISSP, CSSLP, GIAC, or a Kubernetes security certification

Working Environment

This is a fully remote position. The selected candidate must comply with all customer security, equipment, access, and remote-work requirements., * Do you have hands-on experience administering and integrating all four tools into CI/CD pipelines: Sonatype Nexus IQ/Lifecycle, Fortify SCA/SSC, StackRox/Red Hat ACS, and Burp Suite?

• Do you have working knowledge of Oracle Cloud Infrastructure (OCI)? Required

Experience:

• Application security engineering or DevSecOps : 5 years (Required)

License/Certification:

• CompTIA Security+ (Required)

• Medical coverage through UnitedHealthcare, with Cornerstone paying 100% of the employee premium on select plans
• 401(k) with a 4% company match
• Paid time off starting at two weeks per year, plus 10 paid holidays
• Dental coverage through Aetna and vision coverage through VSP
• Company-paid basic life insurance and long-term disability for employees enrolled in medical coverage, * 401(k)
• 401(k) matching
• Dental insurance
• Employee discount
• Health insurance
• Health savings account
• Life insurance
• Paid time off
• Retirement plan
• Vision insurance

Cornerstone Technology Enterprises, a veteran-owned small business, is seeking a Senior Application Security Engineer to own and continuously improve the application security (AppSec) scanning ecosystem for a mission-critical program supporting a Department of Defense government customer.

Our government customer delivers systems and services that military members, retirees, and their families depend on every day. Secure, trustworthy software is essential to that mission. As a veteran-owned company, Cornerstone understands what that mission means to the people it serves.

This is a hands-on technical leadership role. You will run and integrate software composition analysis (SCA) with Sonatype, static application security testing (SAST) with Fortify, container and Kubernetes security with Red Hat Advanced Cluster Security (StackRox), and dynamic application security testing (DAST) with Burp Suite across the software development life cycle. You will also assess the tool portfolio, brief senior executive leaders on consolidation opportunities, and lead at least one other AppSec professional., Cornerstone Technology Enterprises, Inc. is a Veteran-Owned Small Business with more than 25 years of experience supporting federal technology programs. Our capabilities include software development, database administration, cloud engineering, cybersecurity, data engineering, DevSecOps, and IT operations.