> Markdown version of [/jobs/ext/4616250-security-engineer](https://www.wearedevelopers.com/jobs/ext/4616250-security-engineer). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Security Engineer - **Company:** Nabout Leidos - **Location:** Omaha, NE, United States (Remote available) - **Experience:** Experienced - **Salary:** $87,100.0 - $157,450.0 - **Contract:** Permanent contract - **Skills:** Java (Programming Language), JavaScript (Programming Language), Applications Architecture, Bash Shell, C++ (Programming Language), CompTIA Security+, Cyber Security, Corona (Software Development Kit), Web Development, Gradle, Integrated Development Environments, Python (Programming Language), Apache Maven, NuGet, Open Source Technology, Open Web Application Security, Package Management Systems, Windows PowerShell, Fortify (Software), Secure Coding, Software Engineering, SonarQube, Software Vulnerability Management, Web Applications, Rust (Programming Language), Scripting, Software Security, Veracode, Sonatype Nexus, Kubernetes, Npm(Software), Checkmarx, Devsecops, Static Application Security Testing, Vulnerability Analysis, Dynamic Application Security Testing - **Published:** November 7, 2026 - **Apply:** https://jobs.military.com/career/390214/application-security-engineer-nebraska-ne-omaha ## About the Role In this role, the successful candidate has significant experience in building modern JavaScript-based web applications, including familiarity with multiple frameworks, strong programming fundamentals, and typical web application development and deployment processes, as well as cybersecurity experience. We're looking for someone who can make risk-based security adjudication decisions, not simply operate vulnerability scanning tools! You must be capable of working on multiple projects at once and seeing them all through to completion, and a self-starter who is able to work through any obstacles to get the job done. \n, * US Citizen with the ability to obtain and maintain a TS/SCI within 365 days of your start date with Leidos. \n * Bachelor's degree with 4+ years of experience or a Master's degree with 2+ years of experience. Additional experience may be considered in lieu of a degree. \n * Experience performing application security assessments, vulnerability analysis, and security risk evaluations across enterprise software applications and development environments. \n * Experience evaluating and adjudicating third-party software libraries, open-source components, and external dependencies for security vulnerabilities, licensing concerns, and software supply chain risks. \n * Working knowledge of Software Composition Analysis (SCA), Static Application Security Testing (SAST), and Dynamic Application Security Testing (DAST) methodologies and tools. \n * Experience analyzing Common Vulnerabilities and Exposures (CVEs), Common Vulnerability Scoring System (CVSS) scores, and vulnerability intelligence to assess applicability, exploitability, and operational risk. \n * Understanding secure software development lifecycle (SSDLC) practices, secure coding principles, and application security best practices. \n * Familiarity with software supply-chain security concepts, including dependency management, Software Bills of Materials (SBOMs), artifact integrity, and vulnerability remediation. \n * Experience collaborating with software development teams to identify, prioritize, document, and remediate application security findings. \n * Working knowledge of common application security risks and vulnerabilities, including the OWASP Top 10 and CWE classifications. \n * Ability to develop technical security assessments, document risk-based adjudication decisions, and communicate findings and recommendations to technical and program stakeholders. \n, * US Citizen with an active TS/SCI security clearance. \n * Experience supporting application security activities within DoD, Intelligence Community, or other highly regulated and security-sensitive software development environments. \n * Experience with modern software development (Java, Python, Javascript, Rust, etc). \n * Experience implementing or managing third-party library approval and adjudication processes, including evaluation of component provenance, known vulnerabilities, transitive dependencies, licensing restrictions, and available mitigation strategies. \n * Hands-on experience with SCA and vulnerability management tools such as Sonatype Nexus IQ, JFrog Xray, Black Duck, Snyk, Mend, Dependency-Track, or equivalent platforms. \n * Experience with application security testing tools such as Fortify, Checkmarx, Veracode, Semgrep, SonarQube, or equivalent technologies. \n * Experience generating, analyzing, and maintaining SBOMs using industry-standard formats such as CycloneDX and SPDX. \n * Familiarity with software supply chain security frameworks and guidance, including NIST SP 800-218 (SSDF), NIST SP 800-53, NIST SP 800-161, and relevant CISA guidance. \n * Experience assessing vulnerability exploitability and prioritizing remediation using VEX, CISA Known Exploited Vulnerabilities (KEV), EPSS, and other threat intelligence sources. \n * Experience integrating automated security scanning, dependency analysis, and compliance checks into CI/CD pipelines and DevSecOps workflows. \n * Experience securing containerized applications, container images, and Kubernetes-based deployment environments. \n * Understanding of software artifact repositories, package managers, and dependency ecosystems such as Maven, Gradle, npm, NuGet, PyPI, and Cargo. \n * Experience evaluating software component provenance, artifact signing, integrity verification, and build-pipeline security using technologies such as Sigstore, SLSA, or equivalent approaches. \n * Ability to evaluate vulnerability findings in the context of actual application architecture, runtime behavior, and operational exposure to distinguish exploitable risks from false positives or non-applicable findings. \n * Experience developing security policies, risk acceptance criteria, vulnerability exception processes, and documented mitigation strategies. \n * Experience with Risk Management Framework (RMF), Authority to Operate (ATO) processes, and security control assessment activities. \n * Experience scripting or automating security analysis workflows using Python, PowerShell, Bash, or similar technologies. \n * Familiarity with secure development practices for Java, C/C++, Rust, JavaScript, or other enterprise programming languages. \n * Relevant industry cybersecurity certifications such as CISSP, CSSLP, Security+, or GIAC GWEB. \n * Experience with USSTRATCOM Nuclear Planning process. \n