Post a Job
All remote jobs
Rackner

Application Security Engineer — Secure Mission Systems

AI Summary
Rackner is seeking an Application Security Engineer to embed security testing and remediation practices across mission-critical Department of Defense software delivery. The role focuses on SAST, DAST, software composition analysis, vulnerability triage, remediation verification, and secure CI/CD integration. Required hands-on tools include Fortify, OWASP ZAP, and JFrog Xray, with GitLab, Artifactory, OpenShift, and Kubernetes as important supporting technologies. The position requires an active final DoD Secret clearance, at least six years of relevant experience, and periodic onsite sprint-planning attendance in Laurel, Maryland. Employment is contingent on contract award, with an anticipated November 2026 start date.
Apply for this job View company
Remote from
USA
Salary
Undisclosed
Department
Cybersecurity
Employment
Full Time
Experience
Open level
Published
Apply before
13 Dec 2026
Listing views
21
Application actions
1
Application toolkit

Make your next move.

Prepare your resume, explore your fit, and draft a cover letter for this opportunity.

Opportunity details

About this role.

Application Security Engineer — Secure Mission Systems

Location: Mainly remote, with onsite work in Laurel, Maryland, typically one day approximately every six weeks for team-wide sprint planning
Clearance: Active final DoD Secret clearance required

This position supports a pending contract opportunity and is contingent upon contract award, with an anticipated start in November 2026.

Build Security into Mission-Critical Software

At Rackner, you will help strengthen secure software supporting high-impact Department of Defense planning and decision-support missions.

This is a hands-on application-security role where you can influence how security is built into software from development through release. You will work closely with software engineers, AI/ML engineers, platform teams, DevSecOps professionals, and customer technical leads to identify meaningful risks, support vulnerability remediation, and strengthen secure-development practices.

Your work will go beyond running scanners or delivering reports. You will help teams understand security findings, separate actionable risks from false positives, verify fixes, improve software supply-chain security, and deliver resilient software with greater confidence.

You will:

  • Integrate application-security testing throughout the software-development lifecycle.
  • Conduct and support static application-security testing using Fortify.
  • Conduct and support dynamic application-security testing using OWASP ZAP.
  • Support software-composition analysis and software supply-chain security using JFrog Xray.
  • Review and triage security findings, identify actionable vulnerabilities, and distinguish meaningful risks from false positives.
  • Work directly with software engineers to understand root causes, support remediation, and verify completed fixes.
  • Integrate automated security scanning into secure CI/CD and GitLab-based development workflows.
  • Strengthen dependency-management and software supply-chain controls throughout development and delivery.
  • Support application security within environments using GitLab, Artifactory, OpenShift, and Kubernetes.
  • Contribute to technical reviews, code reviews, software testing, and security-remediation activities.
  • Produce clear vulnerability findings, remediation reports, code-review observations, and technical documentation.
  • Support verification that software meets applicable functional, coding, and security requirements before release.
  • Collaborate with software, AI/ML, platform, DevSecOps, and customer technical teams.

What You’ll Bring

  • Bachelor’s degree in Cybersecurity.
  • At least six years of experience involving cyber resilience, SAST, DAST, and software-vulnerability remediation.
  • Hands-on experience with Fortify, JFrog Xray, and OWASP ZAP.
  • Identifying, evaluating, triaging, and supporting remediation of application-security vulnerabilities.
  • Working directly with software-development teams to resolve security findings.
  • Experience with software supply-chain security, dependency risk, or software-composition analysis.
  • Understanding of secure software-development lifecycle practices.
  • Integrating automated security scanning into software-development or CI/CD workflows.
  • Ability to clearly document technical findings and communicate them to developers and technical stakeholders.

Experience That Can Strengthen Your Fit

Experience with several of the following can improve alignment:

  • GitLab-based development and CI/CD workflows.
  • Artifactory or similar artifact-management platforms.
  • OpenShift, Kubernetes, and containerized application environments.
  • Additional SAST, DAST, dependency-scanning, or software-composition-analysis tools.
  • Secure-code review and remediation verification.
  • Application-security testing in disconnected, restricted, or customer-managed environments.
  • Supporting classified, defense, aerospace, government, or other regulated software environments.
  • Collaboration across application security, software engineering, platform, DevSecOps, and AI/ML teams.

You do not need equal depth in every area, but your background should include direct experience with the named application-security tools and workflows.

Why Rackner

At Rackner, you will have the opportunity to protect technology supporting critical defense and public-sector missions.

You will work on more than isolated scan execution or vulnerability reports. This role combines hands-on application-security testing, vulnerability analysis, remediation verification, software supply-chain security, and close collaboration across software, AI/ML, platform, and mission-focused teams.

Rackner has delivered more than $30 million in recent federal awards and supports mission-critical work across defense, civilian, and public-sector environments. We are looking for an application-security engineer who can build on that momentum by strengthening secure delivery, helping teams resolve vulnerabilities, and improving confidence in the software reaching mission users.

Benefits & Professional Growth

  • Competitive compensation
  • Company-supported certifications aligned with current and future program work
  • 401(k) with 100% company match up to 6%
  • Medical, dental, vision, life, and disability coverage
  • Paid time off and company holidays
  • Remote-work support and home-office equipment plan
  • Fitness and wellness reimbursement
  • Weekly pay schedule
  • Professional-development and future growth opportunities

Apply

If you are an application-security professional who wants broader influence across secure development, automated security testing, vulnerability remediation, and software supply-chain security, we would like to hear from you.

Apply now >

This job listing has been manually reviewed by the Jobicy Trust & Safety Team for compliance with our posting guidelines, including verification of the company's legitimacy, accuracy of job details, clarity of remote work policy, and absence of misleading or fraudulent content.

Role DNA

A quick view of the complexity, pace, ownership and collaboration implied by the job description.

Job Complexity

5/5
EasyHard

Pace & Pressure

4/5
RelaxedFast-paced

Autonomy Level

4/5
GuidedFull ownership

Communication Load

5/5
IndependentCollaborative
AI insightThis is a senior, security-sensitive engineering role requiring specialized application-security tooling, secure software supply-chain expertise, and an active DoD Secret clearance. The engineer must independently assess risk while collaborating closely with multiple technical and mission stakeholders.

Salary analysis

Estimated compensation compared with the broader US market for similar roles.

Estimated job median (per year)Highly competitive
$180,000
US market range (per year)$150k–$210k
AI insightThe yearly pay period is inferred from the job context; it was not explicitly stated by the employer. No employer base salary was disclosed. The yearly period and USD market estimate are inferred from the senior US-based application-security scope, clearance requirement, and full-time role conventions.

Core skills

Skills and capabilities most closely associated with this opportunity.

Application SecuritySASTDASTFortifyOWASP ZAPJFrog XraySoftware Composition AnalysisSoftware Supply Chain SecurityVulnerability RemediationSecure SDLCGitLab CI/CDKubernetesOpenShiftSecure Code ReviewTechnical Documentation
Sample interview questions
How have you integrated SAST and DAST into a CI/CD pipeline without creating excessive friction for developers?

I establish risk-based pipeline gates, run fast checks early, and reserve longer scans for merge or release stages. I also tune rules, document triage criteria, and provide developers with actionable remediation guidance so findings are relevant rather than noisy.

How would you distinguish a true vulnerability from a false positive identified by Fortify or OWASP ZAP?

I would validate the affected code path or endpoint, assess exploitability and data flow, review the deployment context, and attempt controlled reproduction when appropriate. I would then document the evidence, severity rationale, and recommended disposition for the engineering team.

What approach would you take to managing third-party dependency risk with JFrog Xray?

I would inventory components, prioritize vulnerabilities by exploitability and business impact, identify approved upgrade or mitigation paths, and define policies for prohibited licenses or critical CVEs. I would integrate scanning into artifact promotion so risky builds cannot advance without an approved exception.

Describe how you would verify that a reported security finding has been remediated.

I would review the code or configuration change, confirm that the root cause was addressed, rerun the relevant scanner or targeted test, and validate that no compensating control was weakened. The closure record would include evidence of testing and any residual-risk decision.

How do you communicate security findings to software engineers and technical stakeholders?

I focus on the affected asset, realistic impact, reproduction context, priority, and specific remediation options. I adapt the level of detail to the audience while maintaining clear written evidence that supports engineering action and management risk decisions.

This analysis is generated from the job description. Salary estimates, role characteristics and sample answers are guidance, not employer-provided facts.
Next step

Apply now.

Follow the employer’s application method and review Jobicy’s safety guidance before sharing personal information.

Did you apply?Let us know, and we’ll help you track your application.

Continue on the employer website

Protect your personal information and never pay to secure an interview or job offer. .

Log in to save
One quick step before you apply

Sign in to continue.

Sign in or create a free account to continue to the employer's application.
Add alert
Job Search Safety Tips
Here are some tips to help you search and apply for jobs safely:
Watch out for suspicious jobs Don't apply for jobs that offer high pay for little work or offer to hire you without an interview. Read more ›
Check the employer's profile Make sure you're applying for a trustworthy job by visiting the employer's profile and learning more about them. Read more ›
Protect your information Don't share personal details like your bank account or government-issued ID on suspicious websites or messengers. Read more ›
Report jobs that feel unsafe If you see a job that seems misleading, inappropriate or discriminatory, report it for going against our policies and we'll review it.
Share this job
Jobs Talent AI Tools Salaries
Menu