Application Security Engineer

Description: SciTec has been awarded multiple government contracts and is growing our creative team! SciTec, Inc. is a dynamic small business with the mission to deliver advanced sensor data processing technologies and scientific instrumentation capabilities in support of National Security and Defense. We support customers throughout the Department of Defense and U.S. Government in building innovative new tools to deliver unique world-class data exploitation capabilities.
SciTec has an immediate opportunity for a talented Application Security Engineer in our Boulder, CO office. The Application Security Engineer will support developers in designing, implementing, and verifying secure application environments.
Responsibilities
Perform security analysis of software applications using both automated tooling (static code analysis, software composition analysis, fuzzing) and manual code and design review.
Support integration of tools and processes into DevSecOps pipelines.
Design, implement, and integrate improvements to SciTec's software analysis continuous integration tooling.
Support software developers in remediating issues identified during code analysis.
Support software developers in integrating security into system designs.
Other duties as assigned.
Requirements
Six years of experience in cybersecurity or software development OR a Bachelor's degree and two years of experience OR a Master's degree.
Either two years of experience (industry or open-source contributions) specifically focused on software security OR an academic thesis project (or equivalent) on software security topics.
Candidate must be capable of qualifying for a SECRET DoD or DoE security clearance.
Candidate must be capable of satisfying DoD 8570.01M Information Assurance System Architect and Engineer Level 1 training requirements within six months of hire.
Detail oriented
Good verbal and written communication skills
Candidates who have an active DoD or DoE security clearance will be strongly preferred. In addition, we are seeking candidates who have any of the following skills or experiences:
Experience identifying, exploiting, and remediating application vulnerabilities. Credit for pubished CVEs is a plus.
Experience with one or more of the following programming languages: C++, Python, JavaScript (or TypeScript), Rust
Experience with using and configuring static code analysis tooling (e.g. Coverity, Klockwork, SonarQube, etc.)
Experience with using and configuring software composition analysis tooling (e.g. Sonatype, Anchore, Snyk, JFrog, XRay, etc.)
Experience with vulnerability discovery using fuzzing (AFL, AFL++, honggfuzz, etc.)
Experience with application debugging, runtime instrumentation (Strace, eBPF), and reverse engineering (Ghidra, IDA Pro)
Familiarity with threat modeling tools such as the MITRE ATT&CK framework.
Benefits
SciTec offers a highly competitive salary and benefits package, including:
Employee Stock Ownership Plan (ESOP)
3% Fully Vested Company 401K Contribution (no employee contribution required)
100% company paid HSA Medical insurance, with a choice of 2 buy-up options
80% company paid Dental insurance
100% company paid Vision insurance
100% company paid Life insurance
100% company paid Long-term Disability insurance
100% company paid Hospital Indemnity insurance
Voluntary Accident and Critical Illness insurance
Short-term Disability insurance
Annual Profit-Sharing Plan
Discretionary Performance Bonus
Paid Parental Leave
Generous Paid Time Off, including Vacation, Vacation, and Sick Pay
Flexible Work Hours
The pay range for this position is $90,000 - $146,000/year. SciTec considers several factors when extending an offer of employment, including but not limited to the role and associated responsibilities, a candidate's work experience, education/training, and key skills. This is not a guarantee of compensation.
SciTec is committed to hiring and retaining a diverse workforce and is proud to be an Equal Opportunity/Affirmative Action employer.