Job Requirements
Remote
Secret Polygraph not specified
Mid Level Career (5+ yrs experience)
$120,000 - $125,000
Job Description
Conviso Inc is hiring Application Security Tools Engineer for Remote set-up position & comes with benefits, 401K & some accrued PTO
Title: Application Security Tools Engineer
Active Secret Clearance needed
Remote job
Certification Requirements: DoD 8570 IAT II (e.i. Security+)
Key Responsibilities
Platform ownership & operations
• Deploy, configure, harden, and maintain Sonatype, Fortify, StackRox, and Burp in on-prem and/or accredited cloud environments. The strongest candidates possess Oracle Cloud experience/certifications.
• Manage upgrades, plugins, licensing, capacity planning, backup/restore, high availability, and disaster recovery.
• Establish SLAs/SLOs, monitoring/alerting, and operational runbooks.
CI/CD integration (DevSecOps)
• Integrate tools into CI/CD pipelines (e.g., Jenkins, GitLab CI, etc.) with policy-based gating and risk-based exceptions.
• Standardize developer “secure-by-default” workflows: pull request checks, nightly scans, release readiness criteria.
• Build reusable templates and reference implementations for product teams.
Security policy, tuning, and governance
• Define and tune scanning policies (severity thresholds, exploitability context, allowlists/denylists, quality gates) aligned to agency standards.
• Reduce false positives/negatives through rule tuning, calibration, and developer feedback loops.
• Maintain an auditable vulnerability management workflow: triage, ownership, remediation SLAs, and exception/waiver documentation.
Vulnerability triage & remediation enablement
• Provide actionable findings with clear reproduction steps and secure coding guidance.
• Partner with engineering teams to remediate issues in code, dependencies, container images, and Kubernetes configurations.
• Coordinate retesting and verify fixes (including targeted Burp validation for high-risk apps/APIs).
Container/Kubernetes security (StackRox)
• Implement image scanning, runtime detections, admission controls, and Kubernetes policy enforcement.
• Integrate with registries and orchestration platforms; maintain cluster baselines and least-privilege controls.
• Operationalize incident-ready detections and response playbooks with SOC/IR teams.
Reporting, compliance, and audit support
• Produce metrics and dashboards: vulnerability trends, time-to-remediate, pipeline pass rates, policy exceptions.
• Support Risk Management Framework (RMF) / Authority to Operate (ATO) evidence needs with scan outputs, control mappings, and procedures.
• Experience supporting Agile project management, with hands-on Jira experience strongly preferred.
• Manage a team of at least one other AppSec professional.
Required Qualifications
• 5+ years in application security engineering and/or DevSecOps in regulated environments.
• Hands-on administration and pipeline integration experience with Sonatype (Nexus IQ/Lifecycle), Fortify (SCA/SSC), StackRox/Red Hat ACS, and Burp Suite (Professional/Enterprise preferred).
• Strong CI/CD and automation skills; ability to implement repeatable integrations and policy gates.
Working knowledge of:
• Secure SDLC, OWASP Top 10, dependency risk, SBOM concepts, container/Kubernetes security
• Linux administration, networking fundamentals, TLS/cert management, identity integration (SSO/LDAP)
• Common languages/build systems (e.g., Java/Maven/Gradle, .NET/NuGet, Node/npm, Python/pip)
• Oracle Cloud Infrastructure
Preferred Qualifications
DoD/IC experience with RMF, STIGs, and vulnerability management processes.
Familiarity with registries and orchestration: Harbor/Artifactory/ECR, Kubernetes/OpenShift, Helm.
Experience integrating with SIEM/SOAR and ticketing (e.g., Splunk, ServiceNow, Jira).
Relevant certifications (one or more): Security+, CISSP, CSSLP, GIAC, Kubernetes security certs.
Title: Application Security Tools Engineer
Active Secret Clearance needed
Remote job
Certification Requirements: DoD 8570 IAT II (e.i. Security+)
Key Responsibilities
Platform ownership & operations
• Deploy, configure, harden, and maintain Sonatype, Fortify, StackRox, and Burp in on-prem and/or accredited cloud environments. The strongest candidates possess Oracle Cloud experience/certifications.
• Manage upgrades, plugins, licensing, capacity planning, backup/restore, high availability, and disaster recovery.
• Establish SLAs/SLOs, monitoring/alerting, and operational runbooks.
CI/CD integration (DevSecOps)
• Integrate tools into CI/CD pipelines (e.g., Jenkins, GitLab CI, etc.) with policy-based gating and risk-based exceptions.
• Standardize developer “secure-by-default” workflows: pull request checks, nightly scans, release readiness criteria.
• Build reusable templates and reference implementations for product teams.
Security policy, tuning, and governance
• Define and tune scanning policies (severity thresholds, exploitability context, allowlists/denylists, quality gates) aligned to agency standards.
• Reduce false positives/negatives through rule tuning, calibration, and developer feedback loops.
• Maintain an auditable vulnerability management workflow: triage, ownership, remediation SLAs, and exception/waiver documentation.
Vulnerability triage & remediation enablement
• Provide actionable findings with clear reproduction steps and secure coding guidance.
• Partner with engineering teams to remediate issues in code, dependencies, container images, and Kubernetes configurations.
• Coordinate retesting and verify fixes (including targeted Burp validation for high-risk apps/APIs).
Container/Kubernetes security (StackRox)
• Implement image scanning, runtime detections, admission controls, and Kubernetes policy enforcement.
• Integrate with registries and orchestration platforms; maintain cluster baselines and least-privilege controls.
• Operationalize incident-ready detections and response playbooks with SOC/IR teams.
Reporting, compliance, and audit support
• Produce metrics and dashboards: vulnerability trends, time-to-remediate, pipeline pass rates, policy exceptions.
• Support Risk Management Framework (RMF) / Authority to Operate (ATO) evidence needs with scan outputs, control mappings, and procedures.
• Experience supporting Agile project management, with hands-on Jira experience strongly preferred.
• Manage a team of at least one other AppSec professional.
Required Qualifications
• 5+ years in application security engineering and/or DevSecOps in regulated environments.
• Hands-on administration and pipeline integration experience with Sonatype (Nexus IQ/Lifecycle), Fortify (SCA/SSC), StackRox/Red Hat ACS, and Burp Suite (Professional/Enterprise preferred).
• Strong CI/CD and automation skills; ability to implement repeatable integrations and policy gates.
Working knowledge of:
• Secure SDLC, OWASP Top 10, dependency risk, SBOM concepts, container/Kubernetes security
• Linux administration, networking fundamentals, TLS/cert management, identity integration (SSO/LDAP)
• Common languages/build systems (e.g., Java/Maven/Gradle, .NET/NuGet, Node/npm, Python/pip)
• Oracle Cloud Infrastructure
Preferred Qualifications
DoD/IC experience with RMF, STIGs, and vulnerability management processes.
Familiarity with registries and orchestration: Harbor/Artifactory/ECR, Kubernetes/OpenShift, Helm.
Experience integrating with SIEM/SOAR and ticketing (e.g., Splunk, ServiceNow, Jira).
Relevant certifications (one or more): Security+, CISSP, CSSLP, GIAC, Kubernetes security certs.
group id: 10368240