Staff Application Security

Role: Staff Application Security Engineer

Location: Remote

Employment Type: Full-Time

Salary: $143,000-$214,000 per year

About The AES Group

The AES Group is a premier technology and engineering consulting company that has been bringing businesses and talent together for over 20 years to deliver innovative solutions that have the greatest positive impact on society. AES has helped over 40 business enterprises, including Fortune 500 companies, engage their customers, empower their employees, and transform their business operations with the power of cloud, data, AI, engineering, and other emerging technologies.

About the Role

One of our clients in the defense technology industry is seeking a Staff Application Security Engineer to build and advance a scalable, developer-focused application security program.

This role will establish company-wide Secure Software Development Lifecycle (SDLC) policies, integrate security controls into engineering workflows, and strengthen application and software supply-chain security. The successful candidate will combine hands-on application security expertise with technical leadership to help engineering teams develop, test, build, and release secure software efficiently.

Key Responsibilities

• Establish and continuously improve secure SDLC policies, standards, procedures, and control requirements.

• Assess application security maturity across development teams, source-code repositories, CI/CD pipelines, build systems, and release processes.

• Implement and optimize SAST, DAST, SCA, secrets detection, infrastructure-as-code scanning, and container security tools.

• Partner with developers to identify, prioritize, remediate, and validate application security vulnerabilities.

• Lead threat modeling, secure design reviews, architecture assessments, and security requirements definition.

• Develop risk-based vulnerability management processes, remediation SLAs, exception handling, and risk acceptance procedures.

• Strengthen software supply-chain security through SBOMs, dependency verification, build provenance, artifact signing, and release attestations.

• Establish open-source governance practices covering dependency vulnerabilities, license compliance, component inventories, and approval workflows.

• Collaborate with DevOps and platform engineering to secure CI/CD pipelines, build environments, package registries, secrets, and deployment processes.

• Support vulnerability disclosure, CVE triage, security advisories, and product-security incident response.

• Develop a security champions program and provide secure-coding guidance, developer training, and security enablement.

• Create metrics and reports covering security risks, remediation performance, control coverage, SDLC adoption, and program maturity.

• Support customer assurance, audits, and regulatory compliance activities.

Required Qualifications

• 7+ years of experience in application security, product security, DevSecOps, secure software engineering, or a related cybersecurity field.

• Proven experience designing, implementing, or maturing an application security or secure SDLC program across multiple engineering teams.

• Hands-on experience with SAST, DAST, SCA, secrets scanning, and dependency vulnerability management.

• Experience integrating security controls into source control, CI/CD, build, release, and deployment workflows.

• Strong knowledge of secure coding, API security, authentication, authorization, injection vulnerabilities, insecure deserialization, and business-logic vulnerabilities.

• Experience with threat modeling, security architecture reviews, and risk-based vulnerability management.

• Knowledge of SBOMs, software provenance, artifact signing, build integrity, release attestations, and open-source software governance.

• Familiarity with NIST SP 800-218 (SSDF), OWASP SAMM, SLSA, or comparable frameworks.

• Ability to review production code and scripts in at least one modern programming language.

• Strong communication skills and the ability to explain technical risks to developers, leadership, auditors, and nontechnical stakeholders.

Preferred Qualifications

• Experience implementing SLSA-aligned controls, signed attestations, hardened build systems, and release integrity practices.

• Familiarity with SPDX, CycloneDX, VEX, or CSAF.

• Experience securing cloud-native applications, containers, Kubernetes, APIs, microservices, and infrastructure-as-code.

• Experience with tools such as Snyk, Checkmarx, Veracode, GitHub Advanced Security, GitLab Security, Semgrep, SonarQube, OWASP ZAP, Burp Suite, Mend, or Black Duck.

• Knowledge of NIST SP 800-171, NIST SP 800-53, CMMC, FedRAMP, ISO 27001, or SOC 2.

• Experience supporting defense, government, critical-infrastructure, or other high-assurance environments.

• Relevant certifications such as CSSLP, CISSP, OSWE, GIAC, or equivalent security credentials.

Terms & Conditions for Candidate Portal

Last Updated: May 6th, 2026

Please read these Terms & Conditions ("Agreement", "Terms") carefully before using the Candidate Portal ("Portal", "Service") provided by The AES Group ("we", "us", "our").

By accessing or registering for the Portal, you ("Candidate", "User", "you", "your") agree to be bound by these Terms.

If you do not agree with any part of these Terms, you may not use the Portal.

1. Acceptance of Terms

By accessing or using the Candidate Portal, you affirm that you are at least 18 years old and are legally authorized to enter into this Agreement.

If you are accessing the Portal on behalf of an employer or third party, you represent that you have the authority to bind that entity to these Terms.

2. Purpose of Portal

The Portal is provided as a digital platform for Candidates to:

• Create and manage profiles
• Upload resumes, documents, and other professional details
• View and apply for job opportunities
• Track application status
• Communicate with recruiters and client organizations
• Access profile and document-related information

These Terms govern your use of the Portal and all related services.

3. User Registration & Account Security

• You agree to provide accurate, complete, and current information during signup.
• You are responsible for maintaining the confidentiality of your account credentials.
• You agree to immediately notify us of any unauthorized use of your account.
• You are responsible for all activities that occur under your account.

4. Document Upload & Verification

You understand and agree that:

• All resumes, documents, and information you upload must be true, accurate, and valid
• You are fully responsible for the accuracy and legality of the information you provide
• The Portal may use third-party verification services where applicable
• We reserve the right to reject or remove any document or information that appears invalid or misleading

5. Use of Portal Services

You agree to use the Portal in compliance with:

• Applicable laws and regulations
• Professional standards for IT professionals
• Client-specific requirements
• Instructions provided on the Portal

Prohibited actions include, but are not limited to:

• Uploading false or misleading information
• Interfering with Portal operations
• Sharing your credentials or login with others
• Attempting to bypass or manipulate application processes

6. Job Application

You acknowledge that:

• Job opportunities displayed on the Portal are not guaranteed of employment.
• Applications are subject to client requirements, screening, and approval.
• Job details (role, location, requirements) are subject to change.

7. Profile Accuracy & Updates

• You agree to maintain accurate and up-to-date information in your profile.
• Failure to keep your profile updated may impact your eligibility for job opportunities or result in account restrictions.

8. Privacy & Data Use

Your use of the Portal is subject to our Privacy Policy, which describes how we collect, use, and safeguard your personal information.

By using the Portal, you consent to the collection and use of information as described.

9. Intellectual Property

All intellectual property contained in or presented through the Portal is owned by us or our licensors.

You may not copy, modify, distribute, or otherwise use any Portal content without express written permission.

10. Disclaimer of Warranties

The Portal and all content and services are provided "as is" and "as available."

We make no warranties, express or implied, including:

• Merchantability
• Fitness for a particular purpose
• Accuracy or completeness of information

11. Limitation of Liability

To the fullest extent permitted by law, we are not liable for:

• Direct, indirect, incidental, special, or consequential damages
• Loss of data, profits, or business opportunities
• Claims arising from job application outcomes

12. Amendments

We may modify these Terms at any time.

Changes will be posted on the Portal with an updated "Last Updated" date.

Your continued use of the Portal after changes indicates your acceptance.

13. Termination

We may suspend or terminate your access to the Portal if you violate these Terms or for any reason, with or without notice.