Application Security Engineer

Edgewater Federal Solutions, Inc. is currently seeking an Application Security Engineer who will be a hands-on subject matter expert in Microsoft Azure cloud technologies and application security. The role involves developing the federal customer’s application security program and collaborating with developers to meet strategic security goals.

Responsibilities:

• Drive the strategic maturation of the agency’s Application Security (AppSec) program by defining security standards, scaling automation, and embedding secure development practices across all product lifecycles
• Perform SAST assessments using Veracode and GitHub Advanced Security, identifying code-level vulnerabilities and providing remediation guidance
• Conduct and analyze DAST scans, including configuration, execution, and triage of results
• Evaluate and prioritize vulnerabilities using industry frameworks such as CVSS, CWE, OWASP Top 10, WASC, and SANS Top 25
• Collaborate with development, DevOps, and security teams to integrate security controls into CI/CD pipelines and the broader SDLC
• Provide expert advice on secure coding principles and assist developers in resolving security findings
• Troubleshoot application and connectivity issues in Linux-based environments
• Contributes to the design and implementation of enterprise-wide application security controls
• Ensure alignment with federal security and compliance standards, including NIST 800‑53, FIPS, and FedRAMP
• Maintain awareness of emerging threats, vulnerabilities, and best practices in application security

Requirements:

• Hands-on subject matter expert in Microsoft Azure cloud technologies
• Hands-on experience in application security, security architectures, security tools, and methodologies
• Experience supporting SAST/DAST environments using Veracode
• Experience with SCA tools and vulnerability remediation
• Experience leveraging CI/CD deployment methodologies and infrastructure as code (IaC)
• Experience writing playbooks and scripts for automation tools including Terraform, Ansible for IaC
• Demonstrate proficiency with a scripting or coding language, preferably Python
• Proficiency in automation and scripting, such as PowerShell, Python, Bash, and Terraform
• Ability to discuss Information Security concepts such as defense in depth and zero trust
• Demonstrate ability to communicate ideas both verbally and in writing to management, business and IT stakeholders, and technical resources in language that is appropriate for each group
• Ability to work collaboratively with developers across multiple departments
• Ability to work effectively in a fast-paced, project-oriented environment
• Ability to analyze and prioritize vulnerabilities based on risk
• Strong technical acumen, communication, and influence skills
• Working knowledge of system hardening (CIS, STIGs regulatory compliance)
• Experience working with and supporting Unix/Linux and Windows systems
• Experience with SCA tools and vulnerability remediation in containers
• Container orchestration and container security experience
• 3+ years in application security supporting SAST, DAST, and SCA environments
• 3+ years of experience designing and implementing application security controls
• 3+ years of experience working in Linux-based environments, including troubleshooting application and connectivity issues
• Knowledge of federal security and compliance standards (NIST 800-53, FIPS, FedRAMP)
• Bachelor's degree in computer science or related fields
• Minimum of 8 years of experience in Information Security or related fields
• CISSP or equivalent (CompTIA Security+, CEH, or DoD equivalent)
• Experience in securing Azure cloud infrastructure (i.e., inspection, logging, WAF, VM)
• Experience with Azure DevOps
• Practical implementation and architectural experience in encryption techniques, including data at rest and in transit
• Prior experience as a software developer is highly preferred
• ISC2 Certified Information Systems Security Professional (CISSP)
• ISC2 Certified Secure Software Lifecycle Professional (CSSLP)
• GIAC Web Application Penetration Tester (GWAPT)
• Microsoft Azure Security Engineer (AZ‑500)
• HashiCorp Terraform Associate (Infrastructure as Code)