Application Security Architect & Engineer

Job:
Application Security Architect & Engineer - 6 mo C-H

This role is intended to be a 6 month Contract to Hire role. Sponsorship is not available. For this reason the candidate must be interested and eligible for FTE hire after 6 months.

At least one of these certs below is highly DESIRED (Independently and or with one of the above): AWS Solutions Architect (Associate/Professional) or AWS Security Specialty. If they have one of these certs please upload under the reference tab in Vector if you want us to consider it. If they do not have these, simply put N/A in the skills matrix.

At least one of these certs is

REQUIRED:

CompTIA Security+, ISC2 CC (Certified in Cybersecurity), Offensive Security Certified Professional (OSCP), CCSP (Certified Cloud Security Professional) or CSSLP (Certified Secure Software Lifecycle Professional). To be considered, you must upload a copy of their cert under the reference tab. We will not consider your candidate without this!

At least one of the any is DESIRED:
CompTIA Pen Test+, Certified Ethical Hacker (CEH), or GIAC Certified Intrusion Analyst (GCIA). If they have one of these certs, pls upload under the reference tab in Vector if you want us to consider it. If they do not have these, simply put N/A in the skills matrix.

Application Security Architect & Engineer (6 mo Contract-to-Hire)

Hybrid/Remote (Occasional onsite required)

ABOUT THE ROLE:

Client's is seeking an Application Security Engineer (ASE) with 5+ years of experience to join the Office of Technology under Joint Security Operations. In this role, the ASE serves as a dedicated security partner to application teams, providing guidance on secure design, vulnerability management, and secure development practices. The ASE works collaboratively across the SDLC to ensure security is embedded into application design, development, testing, and deployment.

This includes supporting compliance requirements, delivering training and education, and assisting teams with vulnerability remediation efforts.

The successful candidate will identify and recommend improvements to improve the security of all applications, promote secure coding and development practices, and contribute to ongoing initiatives that reduce risk and strengthen the agency's overall security posture.

Responsibilities include but not limited to:

• Provide security guidance, training, and best practices for development and operations teams.
• Support secure software development by applying knowledge of SDLC, Agile, and Scrum methodologies.
• Evaluate software architecture and design for security risks and alignment with Dev Sec Ops  principles.
• Promote and enforce secure coding standards and guidelines.
• Review source code to identify vulnerabilities and recommend remediation strategies.
• Analyze and secure modern web application architectures, including cloud, APIs, microservices, and client server models.
• Identify and address common vulnerabilities, including those outlined in the OWASP Top 10.
• Support vulnerability remediation, patch management, and continuous improvement efforts.
• Utilize application security testing tools such as SAST, DAST, IAST, and platforms like Accunetix, Veracode, Jenkins, Splunk, Rapid7, and Tenable.
• Interpret and act on findings from SIEM systems, including Splunk.
• Apply knowledge of common security controls and frameworks.
• Ensure compliance with relevant security regulations and standards (e.g., NIST 800‑53, IRS Pub 1075, PCI DSS).
• Implement and evaluate AWS cloud security controls and best practices.
• Create, maintain, and review System Security Plans (SSPs).
• Troubleshoot and resolve complex technical and security-related issues.
• Stay current with evolving threats, technologies, and industry trends.
• Develop detailed plans and communicate risks, impacts, and recommendations effectively.
• Collaborate with application teams, QA engineers, and operations teams to integrate security into workflows.
• Provide constructive, actionable feedback to application teams.
• Communicate technical concepts clearly to both technical and non‑technical audiences.
• Work closely with other security analysts and technology teams to support agency and enterprise security…