Security Engineer

Kforce has a client that is seeking a fully remote Security Engineer., This fully remote Security Engineer will work closely with Engineering to identify, validate, and remediate security risks across applications, cloud infrastructure, containers, and the software development lifecycle.

This is not a traditional SOC or security operations role. The ideal candidate combines application security, an offensive security mindset, and security automation. You should be comfortable reading source code, thinking like an attacker, and working directly with developers to build more secure systems.

Key Tasks:

• Perform secure source code reviews and identify vulnerabilities in applications, APIs, and services
• Build and maintain threat models for new and existing systems
• Partner directly with engineers to explain findings and drive remediation through closure
• Review SAST, DAST, SCA, dependency, container, and SBOM findings and prioritize meaningful risk
• Perform hands-on security testing and reproduce vulnerabilities to determine whether they are exploitable
• Build proofs of concept and attack simulations in controlled Dev, QA, and Test environments
• Use AI and security tooling to improve attack simulation and security testing
• Build security utilities, scripts, integrations, and automation using Python, Go, or similar languages
• Work with Docker, CI/CD pipelines, Infrastructure as Code, and configuration management technologies such as Terraform, Ansible, or Salt
• Help identify and prevent configuration drift through repeatable automated controls
• Support application and cloud security within AWS
• Contribute to security architecture for mobile, data, cloud, and AI/ML initiatives
• Help integrate security into Engineering workflows so vulnerabilities are identified and addressed earlier in development

• Approximately 5-7+ years of relevant software engineering, application security, product security, DevSecOps, penetration testing, or security-engineering experience
• Hands-on Application Security experience
• Experience personally reviewing application source code for security vulnerabilities
• Ability to understand software written in languages such as Python, Go, Java, C#, C/C++, or similar
• Experience with SAST, DAST, SCA, vulnerability management, or dependency security
• Threat-modeling and secure-design experience
• Experience partnering directly with developers to remediate security vulnerabilities
• Understanding of CI/CD pipelines and where security controls should be incorporated
• Cloud-security knowledge, ideally within AWS
• Ability to think from an attacker’s perspective and validate whether a security weakness represents real exposure
• Strong communication and judgment when working directly with Engineering teams

Preferred: Experience with several of the following would be particularly valuable:

• Go/Golang
• Python
• Snyk
• Docker Scout or comparable container-security tools
• Docker and Kubernetes
• Terraform
• Ansible or Salt
• Infrastructure as Code
• Configuration management and configuration-drift detection
• Burp Suite
• OWASP ZAP
• Penetration testing/red teaming
• SAST, DAST and SCA
• SBOM/dependency security
• AWS security
• Security automation
• Policy as Code
• AI/LLM security testing
• Attack simulation
• OSCP, PenTest+, or comparable hands-on offensive-security experience

The pay range is the lowest to highest compensation we reasonably in good faith believe we would pay at posting for this role. We may ultimately pay more or less than this range. Employee pay is based on factors like relevant education, qualifications, certifications, experience, skills, seniority, location, performance, union contract and business needs. This range may be modified in the future.

We offer comprehensive benefits including medical/dental/vision insurance, HSA, FSA, 401(k), and life, disability & ADD insurance to eligible employees. Salaried personnel receive paid time off. Hourly employees are not eligible for paid time off unless required by law. Hourly employees on a Service Contract Act project are eligible for paid sick leave.

Note: Pay is not considered compensation until it is earned, vested and determinable. The amount and availability of any compensation remains in Kforce’s sole discretion unless and until paid and may be modified in its discretion consistent with the law.

By clicking ?Apply Today? you agree to receive calls, AI-generated calls, text messages or emails from Kforce and its affiliates, and service providers. Note that if you choose to communicate with Kforce via text messaging the frequency may vary, and message and data rates may apply. Carriers are not liable for delayed or undelivered messages. You will always have the right to cease communicating via text by using key words such as STOP.