Application Security Engineer

Description: SciTec has been awarded multiple government contracts and is growing our creative team! SciTec, Inc. is a dynamic small business with the mission to deliver advanced sensor data processing technologies and scientific instrumentation capabilities in support of National Security and Defense. We support customers throughout the Department of Defense and U.S. Government in building innovative new tools to deliver unique world-class data exploitation capabilities.

SciTec has an immediate opportunity for a talented Application Security Engineer in our Boulder, CO office. The Application Security Engineer will support developers in designing, implementing, and verifying secure application environments.

Responsibilities

• Perform security analysis of software applications using both automated tooling (static code analysis, software composition analysis, fuzzing) and manual code and design review.
• Support integration of tools and processes into DevSecOps pipelines.
• Design, implement, and integrate improvements to SciTec's software analysis continuous integration tooling.
• Support software developers in remediating issues identified during code analysis.
• Support software developers in integrating security into system designs.
• Other duties as assigned.

Requirements

• Six years of experience in cybersecurity or software development OR a Bachelor's degree and two years of experience OR a Master's degree.
• Either two years of experience (industry or open-source contributions) specifically focused on software security OR an academic thesis project (or equivalent) on software security topics.
• Candidate must be capable of qualifying for a SECRET DoD or DoE security clearance.
• Candidate must be capable of satisfying DoD 8570.01M Information Assurance System Architect and Engineer Level 1 training requirements within six months of hire.
• Detail oriented
• Good verbal and written communication skills

Candidates who have an active DoD or DoE security clearance will be strongly preferred. In addition, we are seeking candidates who have any of the following skills or experiences:

• Experience identifying, exploiting, and remediating application vulnerabilities. Credit for pubished CVEs is a plus.
• Experience with one or more of the following programming languages: C++, Python, JavaScript (or TypeScript), Rust
• Experience with using and configuring static code analysis tooling (e.g. Coverity, Klockwork, SonarQube, etc.)
• Experience with using and configuring software composition analysis tooling (e.g. Sonatype, Anchore, Snyk, JFrog, XRay, etc.)
• Experience with vulnerability discovery using fuzzing (AFL, AFL++, honggfuzz, etc.)
• Experience with application debugging, runtime instrumentation (Strace, eBPF), and reverse engineering (Ghidra, IDA Pro)
• Familiarity with threat modeling tools such as the MITRE ATT&CK framework.

Benefits

SciTec offers a highly competitive salary and benefits package, including:

• Employee Stock Ownership Plan (ESOP)
• 3% Fully Vested Company 401K Contribution (no employee contribution required)
• 100% company paid HSA Medical insurance, with a choice of 2 buy-up options
• 80% company paid Dental insurance
• 100% company paid Vision insurance
• 100% company paid Life insurance
• 100% company paid Long-term Disability insurance
• 100% company paid Hospital Indemnity insurance
• Voluntary Accident and Critical Illness insurance
• Short-term Disability insurance
• Annual Profit-Sharing Plan
• Discretionary Performance Bonus
• Paid Parental Leave
• Generous Paid Time Off, including Holiday, Vacation, and Sick Pay
• Flexible Work Hours

The pay range for this position is $90,000 - $146,000/year. SciTec considers several factors when extending an offer of employment, including but not limited to the role and associated responsibilities, a candidate's work experience, education/training, and key skills. This is not a guarantee of compensation.

SciTec is committed to hiring and retaining a diverse workforce and is proud to be an Equal Opportunity/Affirmative Action employer.