Staff Application Security

Role: Staff Application Security Engineer
Location: Remote
Employment Type: Full-Time
Salary: $143,000–$214,000 per year

About The AES Group
The AES Group is a premier technology and engineering consulting company that has been bringing businesses and talent together for over 20 years to deliver innovative solutions that have the greatest positive impact on society. AES has helped over 40 business enterprises, including Fortune 500 companies, engage their customers, empower their employees, and transform their business operations with the power of cloud, data, AI, engineering, and other emerging technologies.

About the Role

One of our clients in the defense technology industry is seeking a Staff Application Security Engineer to build and advance a scalable, developer-focused application security program.

This role will establish company-wide Secure Software Development Lifecycle (SDLC) policies, integrate security controls into engineering workflows, and strengthen application and software supply-chain security. The successful candidate will combine hands-on application security expertise with technical leadership to help engineering teams develop, test, build, and release secure software efficiently.

Key Responsibilities

• Establish and continuously improve secure SDLC policies, standards, procedures, and control requirements.

• Assess application security maturity across development teams, source-code repositories, CI/CD pipelines, build systems, and release processes.

• Implement and optimize SAST, DAST, SCA, secrets detection, infrastructure-as-code scanning, and container security tools.

• Partner with developers to identify, prioritize, remediate, and validate application security vulnerabilities.

• Lead threat modeling, secure design reviews, architecture assessments, and security requirements definition.

• Develop risk-based vulnerability management processes, remediation SLAs, exception handling, and risk acceptance procedures.

• Strengthen software supply-chain security through SBOMs, dependency verification, build provenance, artifact signing, and release attestations.

• Establish open-source governance practices covering dependency vulnerabilities, license compliance, component inventories, and approval workflows.

• Collaborate with DevOps and platform engineering to secure CI/CD pipelines, build environments, package registries, secrets, and deployment processes.

• Support vulnerability disclosure, CVE triage, security advisories, and product-security incident response.

• Develop a security champions program and provide secure-coding guidance, developer training, and security enablement.

• Create metrics and reports covering security risks, remediation performance, control coverage, SDLC adoption, and program maturity.

• Support customer assurance, audits, and regulatory compliance activities.

Required Qualifications

• 7+ years of experience in application security, product security, DevSecOps, secure software engineering, or a related cybersecurity field.

• Proven experience designing, implementing, or maturing an application security or secure SDLC program across multiple engineering teams.

• Hands-on experience with SAST, DAST, SCA, secrets scanning, and dependency vulnerability management.

• Experience integrating security controls into source control, CI/CD, build, release, and deployment workflows.

• Strong knowledge of secure coding, API security, authentication, authorization, injection vulnerabilities, insecure deserialization, and business-logic vulnerabilities.

• Experience with threat modeling, security architecture reviews, and risk-based vulnerability management.

• Knowledge of SBOMs, software provenance, artifact signing, build integrity, release attestations, and open-source software governance.

• Familiarity with NIST SP 800-218 (SSDF), OWASP SAMM, SLSA, or comparable frameworks.

• Ability to review production code and scripts in at least one modern programming language.

• Strong communication skills and the ability to explain technical risks to developers, leadership, auditors, and nontechnical stakeholders.

Preferred Qualifications

• Experience implementing SLSA-aligned controls, signed attestations, hardened build systems, and release integrity practices.

• Familiarity with SPDX, CycloneDX, VEX, or CSAF.

• Experience securing cloud-native applications, containers, Kubernetes, APIs, microservices, and infrastructure-as-code.

• Experience with tools such as Snyk, Checkmarx, Veracode, GitHub Advanced Security, GitLab Security, Semgrep, SonarQube, OWASP ZAP, Burp Suite, Mend, or Black Duck.

• Knowledge of NIST SP 800-171, NIST SP 800-53, CMMC, FedRAMP, ISO 27001, or SOC 2.

• Experience supporting defense, government, critical-infrastructure, or other high-assurance environments.

• Relevant certifications such as CSSLP, CISSP, OSWE, GIAC, or equivalent security credentials.