Bachelor's Degree in Computer Science, Information Systems or other related field6+ years of programming experienceOr an equivalent combination of education and experienceMaster's Degree in Computer Science, Information Systems or other related field
Proficiency with the implementation, operationalization, and troubleshooting of Static Application Security Testing (SAST) tools such as Semgrep, Snyk, CodeQL, Checkmarx, Veracode, etc.Understanding of Continuous Integration / Continuous Delivery (CI/CD) pipeline tools and processes (e.g. GitHub Actions, GitLab Runners, Azure DevOps, Jenkins, CircleCI, etc.)Experience in software engineering, ideally full stack software development, including modern technologies and application architecturesStrong scripting and automation experience using one or more programming languagesSolid working knowledge of application security fundamentals including the OWASP Top 10, threat modeling, and implementing secure coding practices throughout the Software Development Lifecycle (SDLC)Embraces emerging technologies, including AI tools, to work smarter, solve problems, and drive better business outcomesExcellent written and verbal communication skillsExperience writing or adapting custom SAST rules (Semgrep or CodeQL)Familiarity with additional Application Security tools (e.g. Interactive (IAST), Dynamic (DAST) and API security, SCA, etc.)Familiarity with API Security tools (e.g., NoName, Traceable, Salt, Cequence)Practical hands-on experience validating vulnerabilities and proficiency with Burp SuiteStrong working knowledge of Secure Development Lifecycles and experience triaging and remediating technical vulnerabilities identified by web application scanning toolsUnderstanding of automated security testing approaches and toolsExperience in building and operating security tools within CI/CD pipelinesExperience with proactive integration of security into the development processPast experience as an application security practitioner or software engineer
Minimum 4+ years of experience in Site Reliability Engineering, Cloud Infrastructure Engineering, or Systems Engineering roles supporting federal or highly regulated environments.Expert knowledge and hands-on experience in Microsoft Azure Government, including Azure Networking, Azure Monitor, Azure Automation, and Azure Policy.Proficiency with Infrastructure as Code (IaC) using Terraform, Bicep, or Ansible in version-controlled, team-based environments.Experience building automated security compliance workflows, including patching pipelines and STIG enforcement.Strong understanding of FedRAMP, FISMA, or DoD IL4/IL5 requirements in relation to infrastructure controls and audit evidence.Familiarity with backup, disaster recovery, and business continuity planning (BCP) in cloud environments.
