Application Security Engineer

POSITION SPECIFICSThis position will be located fully onsite in San Diego, CA. Questions about flexible work arrangements may be directed to the hiring manager during the interview process. Periodic travel to local and remote test sites is required. We are seeking a highly skilled Application Security Engineer with a strong foundation in security engineering to join the DevSecOps Team of the Joint Mission Integration and Experimentation (JMIE) Division within the Information Advantage Office at the Applied Research Laboratory (ARL) at Penn State, based in San Diego, CA. The JMIE Division delivers advanced communications capabilities and secure experimentation networks supporting departmental mission partners, including crossdomain data movement, tactical compute environments, and resilient edge processing strengthen secure software design, development, and deployment across our missionfocused environments. In this role, you will champion application security best practices, embed security across the software development lifecycle, and work closely with engineering teams to ensure applications are resilient, compliant, and securely architected from concept to production. ARL is an authorized DoD SkillBridge partner and welcomes all transitioning military members to apply. You will: Lead the integration of application security best practices into Agile and DevSecOps workflows, ensuring security requirements are included from initial design through deployment Conduct deepdive secure code reviews, threat modeling, and architecture analysis to identify vulnerabilities and guide remediation strategies Perform static (SAST), dynamic (DAST), and interactive application security testing, ensuring coverage across microservices, APIs, and containerized applications Develop and maintain secure coding standards, patterns, and guidance used across engineering teams Partner with developers and product owners to ensure secure design decisions, using approaches such as least privilege, secure defaults, zerotrust principles, and defenseindepth Manage and optimize tools supporting application security, including SAST/DAST platforms, software composition analysis (SCA), secretscanning, and container/CI pipeline security tool Evaluate opensource and thirdparty components for vulnerabilities, license risks, and supply chain integrity Guide teams in secure API development, authentication/authorization best practices, cryptographic use, and secure data handling Validate security controls and perform risk analysis for applications undergoing release, modernization, or cloud migration Assist in building a securityfocused engineering culture through training, documentation, and handson developer engagement Collaborate with cybersecurity, cloud, and network teams to ensure application security aligns with enterprise risk, RMF requirements, and overall mission objectives Additional responsibilities for senior-level roles may include: Leading threat modeling sessions, red/blue-team collaboration, and advanced vulnerability analysis Designing scalable AppSec programs and enterprise SDLC security strategies Supporting RMF documentation and security artifacts relevant to applicationlevel controls Acting as a security advisor on highvisibility or missioncritical applications