> Markdown version of [/jobs/ext/4450382-senior-application-security-engineer-fortify-sonatype-stackrox-active-secret](https://www.wearedevelopers.com/jobs/ext/4450382-senior-application-security-engineer-fortify-sonatype-stackrox-active-secret). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Senior Application Security Engineer - Fortify, Sonatype, StackRox - Active Secret

- **Company:** Cornerstone Tech, Inc.
- **Location:** United States (Remote available)
- **Experience:** Expert
- **Salary:** $165,000 - $175,000
- **Contract:** Permanent contract
- **Skills:** Kubernetes Security, Java (Programming Language), .NET Framework, Application Programming Interfaces (APIs), Agile Methodology, JIRA, Burp Suite, Cloud Computing, CompTIA Security+, Continuous Integration, Disaster Recovery, Gradle, Python (Programming Language), Lightweight Directory Access Protocols (LDAP), Linux System Administration, Apache Maven, Networking Basics, Cisco Nexus Switches, Node.Js, NuGet, OpenShift, Open Web Application Security, Red Hat Enterprise Linux, Fortify (Software), Secure Coding, Security Information and Event Management, Systems Integration, Software Vulnerability Management, Backup and Restore, SSL Certificate Management, Transport Layer Security, System Availability, Sonatype, Software Security, Sonatype Nexus, Gitlab-ci, Kubernetes, Bug Reporting, Enterprise Integration, Build Tools, Npm(Software), Oracle Cloud Infrastructure, Splunk, Devsecops, Jenkins, Servicenow, Artifactory
- **Published:** October 26, 2026
- **Apply:** https://www.indeed.com/viewjob?jk=b72dd7052750d311

## About the Role

* Active Secret security clearance and a current CompTIA Security+ certification or another certification satisfying the customer's DoD 8570 IAT Level II requirement
 * Five or more years of application security engineering or DevSecOps experience in regulated environments
 * Hands-on administration and pipeline integration experience with Sonatype (Nexus IQ/Lifecycle), Fortify (SCA/SSC), StackRox/Red Hat ACS, and Burp Suite (Professional or Enterprise preferred)
 * Strong CI/CD and automation skills, with the ability to build repeatable integrations and policy gates
 * Working knowledge of secure SDLC practices, OWASP Top 10, dependency risk, SBOM concepts, and container and Kubernetes security
 * Linux administration, networking fundamentals, TLS and certificate management, and identity integration (SSO/LDAP)
 * Familiarity with common languages and build systems, such as Java/Maven/Gradle, .NET/NuGet, Node/npm, and Python/pip
 * Working knowledge of Oracle Cloud Infrastructure (OCI)
 * Strong communication skills, including the ability to brief senior leaders and guide other engineers, * Oracle Cloud Infrastructure experience or certifications (strongly preferred)
 * Department of Defense or Intelligence Community experience with RMF, STIGs, and vulnerability management processes
 * Experience with registries and orchestration platforms, such as Harbor, Artifactory, ECR, Kubernetes, OpenShift, and Helm
 * Experience integrating security tools with SIEM/SOAR and ticketing platforms, such as Splunk, ServiceNow, and Jira
 * Hands-on Jira experience supporting Agile project management
 * One or more additional certifications, such as CISSP, CSSLP, GIAC, or a Kubernetes security certification

Working Environment

This is a fully remote position. The selected candidate must comply with all customer security, equipment, access, and remote-work requirements., * Do you have hands-on experience administering and integrating all four tools into CI/CD pipelines: Sonatype Nexus IQ/Lifecycle, Fortify SCA/SSC, StackRox/Red Hat ACS, and Burp Suite?

 * Do you have working knowledge of Oracle Cloud Infrastructure (OCI)? Required

Experience:

 * Application security engineering or DevSecOps : 5 years (Required)

License/Certification:

 * CompTIA Security+ (Required)

## Description

* Deploy, configure, harden, and maintain Sonatype, Fortify, StackRox, and Burp Suite in on-premises and accredited cloud environments, including Oracle Cloud Infrastructure (OCI)
 * Manage upgrades, plugins, licensing, capacity planning, backup and restore, high availability, and disaster recovery, and establish SLAs/SLOs, monitoring, alerting, and operational runbooks
 * Integrate scanning tools into CI/CD pipelines such as Jenkins and GitLab CI, with policy-based gating and risk-based exceptions
 * Standardize secure-by-default developer workflows, including pull request checks, nightly scans, and release readiness criteria, and build reusable templates and reference implementations for product teams
 * Define and tune scanning policies, including severity thresholds, exploitability context, allowlists and denylists, and quality gates, and reduce false positives and negatives through rule tuning and developer feedback
 * Maintain an auditable vulnerability management workflow covering triage, ownership, remediation SLAs, and exception and waiver documentation
 * Deliver actionable findings with reproduction steps and secure coding guidance, partner with engineering teams on remediation, and verify fixes, including targeted Burp Suite validation for high-risk applications and APIs
 * Implement StackRox image scanning, runtime detections, admission controls, and Kubernetes policy enforcement, and operationalize detections and response playbooks with SOC and incident response teams
 * Produce metrics and dashboards on vulnerability trends, time to remediate, pipeline pass rates, and policy exceptions, and support RMF/ATO evidence with scan outputs, control mappings, and procedures
 * Perform tool assessments and present recommendations to senior executive leaders, and lead and mentor at least one other AppSec professional within an Agile, Jira-based delivery model