> Markdown version of [/jobs/ext/4580085-application-security-engineer](https://www.wearedevelopers.com/jobs/ext/4580085-application-security-engineer). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Application Security Engineer - **Company:** ARL, INC. - **Location:** San Diego, CA, United States (Remote available) - **Salary:** $92,100.0 - $152,004.0 - **Contract:** Permanent contract - **Skills:** Java (Programming Language), JavaScript (Programming Language), Application Programming Interfaces (APIs), Agile Methodology, Amazon Web Services, Applications Architecture, User Authentication, Microsoft Azure, C Sharp (Programming Language), Cloud Engineering, Cyber Security, Continuous Integration, Extract Transform Load (ETL), Data Security, Distributed Systems, Mobile Application Software, Python (Programming Language), Open Source Technology, Systems Development Life Cycle, Role-Based Access Control, Zero Trust Network Access, Secure Coding, Software Engineering, TypeScript, Software Vulnerability Management, Cloud Platform System, Software Security, GWAPT, Containerization, Devsecops, Static Application Security Testing, Vulnerability Analysis, Microservices, Dynamic Application Security Testing - **Published:** November 5, 2026 - **Apply:** https://www.dice.com/job-detail/c06f1fd2-bdcf-46aa-a397-79073e292828 ## About the Role * Strong background in application security, including secure development practices, vulnerability analysis, and secure design principles * Versed in SAST, DAST, SCA, and CI/CD security integration * Proficiency with secure coding techniques in one or more languages (e.g., Python, Java, C#, JavaScript/TypeScript, Go) * Experience reviewing application architectures, microservices, and containerized workloads for security weaknesses * Familiarity with NIST 800-53 or similar control frameworks as they relate to application-level security requirements * Strong understanding of authentication, authorization, encryption, and API security best practices * Strong background in cybersecurity disciplines, including vulnerability management, scanning, compliance evaluation, and control implementation * Experience interpreting security policy, generating evidence, and documenting test results for NIST 800-53 / JSIG security controls * Active TS/SCI clearance Preferred Skills/Experience include: * Experience operating within DevSecOps pipelines and modern CI/CD ecosystems * Knowledge of cloud-native application security (AWS, Azure, or DoD cloud environments) * Experience with secure design reviews for APIs, distributed systems, mobile applications, or cross-domain solutions * Background with eMASS, STIGs, or ACAS in support of application accreditation efforts * Relevant certifications: CSSLP, GWAPT, GWEB, GCSA, GSSP, or CISSP Prior experience delivering developer security training or building secure coding programs MINIMUM EDUCATION, WORK EXPERIENCE & REQUIRED CERTIFICATIONS Bachelor's Degree3+ years of relevant experience; or an equivalent combination of education and experience acceptedRequired Certifications:None ## Description This position will be located fully onsite in San Diego, CA. Questions about flexible work arrangements may be directed to the hiring manager during the interview process., We are seeking a highly skilled Application Security Engineer with a strong foundation in security engineering to join the DevSecOps Team of the Joint Mission Integration and Experimentation (JMIE) Division within the Information Advantage Office at the Applied Research Laboratory (ARL) at Penn State, based in San Diego, CA. The JMIE Division delivers advanced communications capabilities and secure experimentation networks supporting departmental mission partners, including cross-domain data movement, tactical compute environments, and resilient edge processing strengthen secure software design, development, and deployment across our mission-focused environments. In this role, you will champion application security best practices, embed security across the software development lifecycle, and work closely with engineering teams to ensure applications are resilient, compliant, and securely architected from concept to production. ARL is an authorized DoD SkillBridge partner and welcomes all transitioning military members to apply. You will: * Lead the integration of application security best practices into Agile and DevSecOps workflows, ensuring security requirements are included from initial design through deployment * Conduct deep-dive secure code reviews, threat modeling, and architecture analysis to identify vulnerabilities and guide remediation strategies * Perform static (SAST), dynamic (DAST), and interactive application security testing, ensuring coverage across microservices, APIs, and containerized applications * Develop and maintain secure coding standards, patterns, and guidance used across engineering teams * Partner with developers and product owners to ensure secure design decisions, using approaches such as least privilege, secure defaults, zero-trust principles, and defense-in-depth * Manage and optimize tools supporting application security, including SAST/DAST platforms, software composition analysis (SCA), secret-scanning, and container/CI pipeline security tool * Evaluate open-source and third-party components for vulnerabilities, license risks, and supply chain integrity * Guide teams in secure API development, authentication/authorization best practices, cryptographic use, and secure data handling * Validate security controls and perform risk analysis for applications undergoing release, modernization, or cloud migration * Assist in building a security-focused engineering culture through training, documentation, and hands-on developer engagement * Collaborate with cybersecurity, cloud, and network teams to ensure application security aligns with enterprise risk, RMF requirements, and overall mission objectives Additional responsibilities for senior-level roles may include: * Leading threat modeling sessions, red/blue-team collaboration, and advanced vulnerability analysis Designing scalable AppSec programs and enterprise SDLC security strategies * Supporting RMF documentation and security artifacts relevant to application-level controls * Acting as a security advisor on high-visibility or mission-critical applications, ARL's purpose is to research and develop innovative solutions to challenging scientific, engineering, and technology problems in support of the Navy, the Intel Community (IC), and other federal government customers.FOR FURTHER INFORMATION on ARL, visit our website at ;/b> BACKGROUND CHECKS/CLEARANCES Employment with the University will require successful completion of background check(s) in accordance with University policies. Notice regarding employment at the Applied Research Laboratory (ARL):Employees must be eligible to obtain a government security clearance, participate in the ARL drug testing program, and comply with electronic and physical monitoring requirements applicable to federal contractors. ARL operates in a secure information environment involving Unclassified, Controlled Unclassified Information (CUI), and Classified information. Personal electronic devices brought onsite must be registered and may be restricted from certain areas.