Application Security Engineer

Battelle seeks an Application Security Engineer to conduct independent verification and validation of mission-critical software supporting DHS research, development, and innovation efforts. The role analyzes software and firmware for vulnerabilities, recommends remediation, reports and briefs findings, and collaborates with development and research teams on security solutions.

Responsibilities:

• Evaluate and analyze application software and firmware source code and binaries for exploitable weaknesses
• Utilize application security testing tools to identify potential vulnerabilities
• Conduct Static Application Security Testing (SAST) on source code repositories and executable binaries
• Research exploitation methods and develop exploits for identified vulnerabilities
• Write vulnerability remediation recommendations, including updates, source code corrections, or other mitigations
• Write in-depth software security reports that include summarized findings and describe the risks
• Present findings to software development teams
• Brief assessment results to senior leadership and executives
• Reverse engineer application software and firmware binaries when required under the guidance of the Senior Application Security Engineer
• Evaluate and analyze leading edge security technologies to be implemented to improve the organization’s security posture
• Work with research and development (R&D) organizations to define requirements to design and develop leading-edge security solutions
• Collaborate with fellow Cyber Security Practice Team Members both locally and across the Cyber Security Practice in the full-lifecycle development and delivery of security technology solutions
• Actively contribute to the Battelle Cyber process improvement initiatives
• Actively participate in leading edge cyber security conferences, working groups and training

Requirements:

• Active DoD SECRET Clearance or DHS “Enter on Duty” (EOD) or “Full Suitability Approval” (FSA) Background Investigation status; US Citizenship required
• 5+ years software engineering experience with compiled and interpretive programming languages
• 4+ years of experience in information assurance and/or cybersecurity
• Bachelors Degree (BS/BA)
• Experience with decompiling and reverse engineering tools such as Ghidra and JDecompiler
• Experience with SAST tools such as Black Duck Coverity
• Experience with software composition analysis tools such as Anchore Syft
• Familiarity with Software Bills of Materials (SBOMs)
• Experience with virtual machines
• Experience with common Linux distributions, such as Ubuntu and Red Hat
• Experience programming in Java, C/C++, C#/.NET, Python, and JavaScript
• Proven experience working in collaborative sessions demonstrating strong verbal and written communication skills along with tactful negotiation skills
• Certified Information Systems Professional (CISSP)
• Current DHS Security Suitability
• M.S. in Information Systems or related field
• Certified Secure Software Lifecycle Professional (CSSLP)
• Experience with Ruby, Rust, Go, TypeScript, and PHP
• Experience with Continuous Integration / Continuous Development (CI /CD) Pipelines
• Penetration Testing experience and/or certifications
• Experience with C-UAS, Sea (Maritime), Air, and/or Border operations and DHS systems
• Experience with IT Security Engineering in support of systems development, interface, and/or architecture requirements and concepts
• Familiarity with MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK) Framework
• Familiarity with NIST SP 800-53 Rev. 5
• Familiarity with DHS 4300A
• Experience with cloud application security
• Experience with cloud environment operations
• Consulting environment experience
• Military veteran with relevant Application Security, IT and computer security experience will be considered a plus