[All remote jobs](https://jobicy.com/jobs.md)[![Rackner logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2026/11/05f1f6baeea0-221.webp)](https://jobicy.com/company/rackner.md)[Rackner](https://jobicy.com/company/rackner.md) # Application Security Engineer — Secure Mission Systems AI Summary Rackner is seeking an Application Security Engineer to embed security testing and remediation practices across mission-critical Department of Defense software delivery. The role focuses on SAST, DAST, software composition analysis, vulnerability triage, remediation verification, and secure CI/CD integration. Required hands-on tools include Fortify, OWASP ZAP, and JFrog Xray, with GitLab, Artifactory, OpenShift, and Kubernetes as important supporting technologies. The position requires an active final DoD Secret clearance, at least six years of relevant experience, and periodic onsite sprint-planning attendance in Laurel, Maryland. Employment is contingent on contract award, with an anticipated November 2026 start date.[Apply for this job](#job-application)[View company](https://jobicy.com/company/rackner.md)ShareRemote from[USA](https://jobicy.com/job-region/usa.md)SalaryUndisclosedDepartment[Cybersecurity](https://jobicy.com/categories/cybersecurity.md)EmploymentFull TimeExperienceOpen levelPublished13 Nov 2026Apply before13 Dec 2026Listing views36Application actions1Application toolkit ## Make your next move. Prepare your resume, explore your fit, and draft a cover letter for this opportunity. Opportunity details ## About this role. Application Security Engineer — Secure Mission Systems Location: Mainly remote, with onsite work in Laurel, Maryland, typically one day approximately every six weeks for team-wide sprint planning Clearance: Active final DoD Secret clearance required This position supports a pending contract opportunity and is contingent upon contract award, with an anticipated start in November 2026. Build Security into Mission-Critical Software At [Rackner](https://jobicy.com/company/rackner.md), you will help strengthen secure software supporting high-impact Department of Defense planning and decision-support missions. This is a hands-on application-security role where you can influence how security is built into software from development through release. You will work closely with software engineers, AI/ML engineers, platform teams, DevSecOps professionals, and customer technical leads to identify meaningful risks, support vulnerability remediation, and strengthen secure-development practices. Your work will go beyond running scanners or delivering reports. You will help teams understand security findings, separate actionable risks from false positives, verify fixes, improve software supply-chain security, and deliver resilient software with greater confidence. You will: * Integrate application-security testing throughout the software-development lifecycle. * Conduct and support static application-security testing using Fortify. * Conduct and support dynamic application-security testing using OWASP ZAP. * Support software-composition analysis and software supply-chain security using JFrog Xray. * Review and triage security findings, identify actionable vulnerabilities, and distinguish meaningful risks from false positives. * Work directly with software engineers to understand root causes, support remediation, and verify completed fixes. * Integrate automated security scanning into secure CI/CD and GitLab-based development workflows. * Strengthen dependency-management and software supply-chain controls throughout development and delivery. * Support application security within environments using GitLab, Artifactory, OpenShift, and Kubernetes. * Contribute to technical reviews, code reviews, software testing, and security-remediation activities. * Produce clear vulnerability findings, remediation reports, code-review observations, and technical documentation. * Support verification that software meets applicable functional, coding, and security requirements before release. * Collaborate with software, AI/ML, platform, DevSecOps, and customer technical teams. What You’ll Bring * Bachelor’s degree in Cybersecurity. * At least six years of experience involving cyber resilience, SAST, DAST, and software-vulnerability remediation. * Hands-on experience with Fortify, JFrog Xray, and OWASP ZAP. * Identifying, evaluating, triaging, and supporting remediation of application-security vulnerabilities. * Working directly with software-development teams to resolve security findings. * Experience with software supply-chain security, dependency risk, or software-composition analysis. * Understanding of secure software-development lifecycle practices. * Integrating automated security scanning into software-development or CI/CD workflows. * Ability to clearly document technical findings and communicate them to developers and technical stakeholders. Experience That Can Strengthen Your Fit Experience with several of the following can improve alignment: * GitLab-based development and CI/CD workflows. * Artifactory or similar artifact-management platforms. * OpenShift, Kubernetes, and containerized application environments. * Additional SAST, DAST, dependency-scanning, or software-composition-analysis tools. * Secure-code review and remediation verification. * Application-security testing in disconnected, restricted, or customer-managed environments. * Supporting classified, defense, aerospace, government, or other regulated software environments. * Collaboration across application security, software engineering, platform, DevSecOps, and AI/ML teams. You do not need equal depth in every area, but your background should include direct experience with the named application-security tools and workflows. Why Rackner At Rackner, you will have the opportunity to protect technology supporting critical defense and public-sector missions. You will work on more than isolated scan execution or vulnerability reports. This role combines hands-on application-security testing, vulnerability analysis, remediation verification, software supply-chain security, and close collaboration across software, AI/ML, platform, and mission-focused teams. Rackner has delivered more than $30 million in recent federal awards and supports mission-critical work across defense, civilian, and public-sector environments. We are looking for an application-security engineer who can build on that momentum by strengthening secure delivery, helping teams resolve vulnerabilities, and improving confidence in the software reaching mission users. Benefits & Professional Growth * Competitive compensation * Company-supported certifications aligned with current and future program work * 401(k) with 100% company match up to 6% * Medical, dental, vision, life, and disability coverage * Paid time off and company holidays * Remote-work support and home-office equipment plan * Fitness and wellness reimbursement * Weekly pay schedule * Professional-development and future growth opportunities Apply If you are an application-security professional who wants broader influence across secure development, automated security testing, vulnerability remediation, and software supply-chain security, we would like to hear from you. Show more [Apply now >](https://jobicy.com/jobs/161922-application-security-engineer-secure-mission-systems.md) > Annual salary information is not provided for this position. Explore salary ranges for similar roles in our [Salary Directory ›](https://jobicy.com/salaries.md) * ![Upload CV](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI2NSIgaGVpZ2h0PSI2NSIgZmlsbD0ibm9uZSIgeG1sbnM6dj0iaHR0cHM6Ly92ZWN0YS5pby9uYW5vIj48ZyBjbGlwLXBhdGg9InVybCgjQSkiPjxwYXRoIGQ9Ik0wIDBINjVWNjVIMFYwWiIgZmlsbD0iIzAyOWFlYiIvPjxnIGZpbGw9IiNmZmYiIHN0cm9rZT0iI2ZmZiIgc3Ryb2tlLXdpZHRoPSIyIj48cGF0aCBkPSJNMzMuMDQ5IDE1LjQ1NGExLjQzIDEuNDMgMCAwIDAtMi4wOTcgMGwtNy41NzkgOC4xNDdhMS4zOCAxLjM4IDAgMCAwIC4wOSAxLjk3MyAxLjQ0IDEuNDQgMCAwIDAgMi4wMDgtLjA4OGw1LjEwOS01LjQ5MnYyMC42MWExLjQxIDEuNDEgMCAwIDAgMS40MjEgMS4zOTdjLjc4NSAwIDEuNDIxLS42MjUgMS40MjEtMS4zOTd2LTIwLjYxbDUuMTA5IDUuNDkyYTEuNDQgMS40NCAwIDAgMCAyLjAwOC4wODggMS4zOCAxLjM4IDAgMCAwIC4wOS0xLjk3M2wtNy41NzktOC4xNDZ6TTE2Ljc2OSAzOC40YzAtLjc3My0uNjItMS40LTEuMzg1LTEuNFMxNCAzNy42MjcgMTQgMzguNHYuMTAybC4yMTUgNi4yMjljLjIyMyAxLjY4LjcwMSAzLjA5NSAxLjgxMyA0LjIxOHMyLjUxIDEuNjA3IDQuMTcyIDEuODMzYzEuNi4yMTggMy42MzYuMjE4IDYuMTYuMjE4aDExLjI4bDYuMTYtLjIxOGMxLjY2Mi0uMjI2IDMuMDYxLS43MDkgNC4xNzItMS44MzNzMS41ODktMi41MzggMS44MTMtNC4yMThDNTAgNDMuMTEzIDUwIDQxLjA1NSA1MCAzOC41MDNWMzguNGMwLS43NzMtLjYyLTEuNC0xLjM4NS0xLjRzLTEuMzg1LjYyNy0xLjM4NSAxLjRsLS4xOSA1Ljk1OGMtLjE4MiAxLjM3LS41MTUgMi4wOTUtMS4wMjYgMi42MTJzLTEuMjI4Ljg1My0yLjU4MyAxLjAzOGMtMS4zOTUuMTktMy4yNDMuMTkzLTUuODkzLjE5M0gyNi40NjJjLTIuNjUgMC00LjQ5OC0uMDAzLTUuODkzLS4xOTMtMS4zNTUtLjE4NC0yLjA3Mi0uNTIxLTIuNTgzLTEuMDM4cy0uODQ0LTEuMjQyLTEuMDI2LTIuNjEyYy0uMTg3LTEuNDEtLjE5MS0zLjI3OS0uMTkxLTUuOTU4eiIvPjwvZz48L2c+PGRlZnM+PGNsaXBQYXRoIGlkPSJBIj48cGF0aCBmaWxsPSIjZmZmIiBkPSJNMCAwaDY1djY1SDB6Ii8+PC9jbGlwUGF0aD48L2RlZnM+PC9zdmc+) ### Upload your resume now To unlock remote work opportunities and be discovered by global employers. This job listing has been manually reviewed by the Jobicy Trust & Safety Team for compliance with our posting guidelines, including verification of the company's legitimacy, accuracy of job details, clarity of remote work policy, and absence of misleading or fraudulent content. ## Role DNA A quick view of the complexity, pace, ownership and collaboration implied by the job description. ### Job Complexity 5/5EasyHard ### Pace & Pressure 4/5RelaxedFast-paced ### Autonomy Level 4/5GuidedFull ownership ### Communication Load 5/5IndependentCollaborative AI insightThis is a senior, security-sensitive engineering role requiring specialized application-security tooling, secure software supply-chain expertise, and an active DoD Secret clearance. The engineer must independently assess risk while collaborating closely with multiple technical and mission stakeholders. ## Salary analysis Estimated compensation compared with the broader US market for similar roles. Estimated job median (per year)Highly competitive$180,000US market range (per year)$150k–$210k0$231.00k AI insightThe yearly pay period is inferred from the job context; it was not explicitly stated by the employer. No employer base salary was disclosed. The yearly period and USD market estimate are inferred from the senior US-based application-security scope, clearance requirement, and full-time role conventions. ## Core skills Skills and capabilities most closely associated with this opportunity. [Application Security](https://jobicy.com/jobs?search_keywords=Application%20Security.md)[SAST](https://jobicy.com/jobs?search_keywords=SAST.md)[DAST](https://jobicy.com/jobs?search_keywords=DAST.md)[Fortify](https://jobicy.com/jobs?search_keywords=Fortify.md)[OWASP ZAP](https://jobicy.com/jobs?search_keywords=OWASP%20ZAP.md)[JFrog Xray](https://jobicy.com/jobs?search_keywords=JFrog%20Xray.md)[Software Composition Analysis](https://jobicy.com/jobs?search_keywords=Software%20Composition%20Analysis.md)[Software Supply Chain Security](https://jobicy.com/jobs?search_keywords=Software%20Supply%20Chain%20Security.md)[Vulnerability Remediation](https://jobicy.com/jobs?search_keywords=Vulnerability%20Remediation.md)[Secure SDLC](https://jobicy.com/jobs?search_keywords=Secure%20SDLC.md)[GitLab CI/CD](https://jobicy.com/jobs?search_keywords=GitLab%20CICD.md)[Kubernetes](https://jobicy.com/jobs?search_keywords=Kubernetes.md)[OpenShift](https://jobicy.com/jobs?search_keywords=OpenShift.md)[Secure Code Review](https://jobicy.com/jobs?search_keywords=Secure%20Code%20Review.md)[Technical Documentation](https://jobicy.com/jobs?search_keywords=Technical%20Documentation.md) Sample interview questionsHow have you integrated SAST and DAST into a CI/CD pipeline without creating excessive friction for developers?I establish risk-based pipeline gates, run fast checks early, and reserve longer scans for merge or release stages. I also tune rules, document triage criteria, and provide developers with actionable remediation guidance so findings are relevant rather than noisy. How would you distinguish a true vulnerability from a false positive identified by Fortify or OWASP ZAP? I would validate the affected code path or endpoint, assess exploitability and data flow, review the deployment context, and attempt controlled reproduction when appropriate. I would then document the evidence, severity rationale, and recommended disposition for the engineering team. What approach would you take to managing third-party dependency risk with JFrog Xray? I would inventory components, prioritize vulnerabilities by exploitability and business impact, identify approved upgrade or mitigation paths, and define policies for prohibited licenses or critical CVEs. I would integrate scanning into artifact promotion so risky builds cannot advance without an approved exception. Describe how you would verify that a reported security finding has been remediated. I would review the code or configuration change, confirm that the root cause was addressed, rerun the relevant scanner or targeted test, and validate that no compensating control was weakened. The closure record would include evidence of testing and any residual-risk decision. How do you communicate security findings to software engineers and technical stakeholders? I focus on the affected asset, realistic impact, reproduction context, priority, and specific remediation options. I adapt the level of detail to the audience while maintaining clear written evidence that supports engineering action and management risk decisions. Next step ## Apply now. Follow the employer’s application method and review Jobicy’s safety guidance before sharing personal information. Keep exploring ## Related remote jobs. * ![ANGI logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2021/09/50cccf084c34089de2274f72e18841d0.jpg) ANGI Nov 13 New ### [Senior Security Engineer, Detection & Response](https://jobicy.com/jobs/161962-senior-security-engineer-detection-response.md) For over 30 years, Angi has powered the future of the home services industry, creating an environment where homeowners and pros benefit from more jobs done well. For homeowners, our… * ![ANGI logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2021/09/50cccf084c34089de2274f72e18841d0.jpg) ANGI Nov 13 New ### [Senior Security Engineer, Application Security](https://jobicy.com/jobs/161957-senior-security-engineer-application-security.md) For over 30 years, Angi has powered the future of the home services industry, creating an environment where homeowners and pros benefit from more jobs done well. For homeowners, our… * ![Domino Data Lab logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2026/11/2b7332248704-221.webp) Domino Data Lab Nov 13 New ### [Staff Software Engineer, Identity and Authorization](https://jobicy.com/jobs/161940-staff-software-engineer-identity-and-authorization.md) Who we are At Domino, we build solutions that help the largest, highly regulated organizations adopt AI to accelerate mission-critical use cases. Our platform integrates a streamlined model and app… * ![Domino Data Lab logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2026/11/2b7332248704-221.webp) Domino Data Lab Nov 13 New ### [Senior Software Engineer, Patch Engineering & Vulnerability Remediation](https://jobicy.com/jobs/161935-senior-software-engineer-patch-engineering-vulnerability-remediation.md) Who we are At Domino, we build solutions that help the largest, highly regulated organizations adopt AI to accelerate mission-critical use cases. Our platform integrates a streamlined model and app… * ![TRM Labs logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/34aa038c-221.png) TRM Labs Nov 13 New ### [Global Investigator – National Security](https://jobicy.com/jobs/161913-global-investigator-national-security.md) Build a Safer World. TRM Labs provides AI-powered intelligence solutions that help public and private sector agencies investigate and disrupt crime. TRM’s platforms enable investigators to trace illicit activity, build… * ![UpGuard logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/474a12c7-221.png) UpGuard Nov 13 New ### [Staff Security Engineer (Product & Cloud)](https://jobicy.com/jobs/161789-staff-security-engineer-product-cloud.md) Who are we? At UpGuard, we are replacing manual security bottlenecks with AI-driven precision. Fresh off a US$75M Series C, we are scaling our infrastructure to process 100 billion risk… * ![TITAN logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/08/81b82aeb-221.png) TITAN Nov 13 New ### [Chief Information Security Officer (CISO), RFA](https://jobicy.com/jobs/161782-chief-information-security-officer-ciso-rfa.md) About RFA and Titan RFA is a leading IT and cybersecurity partner to financial services firms: hedge funds, private equity, asset managers, and the firms that serve them. RFA is… * ![Nebius logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2026/06/d90c0566-221.webp) Nebius Nov 13 New ### [Detection & Response Engineer](https://jobicy.com/jobs/161755-detection-response-engineer-2.md) About Nebius: Nebius is leading a new era in cloud infrastructure for the global AI economy. We are building a full-stack AI cloud platform that supports developers and enterprises from… * ![Canonical logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/b4d068a9-221-1.png) Canonical Nov 12 New ### [Linux Cryptography and Security Engineer](https://jobicy.com/jobs/161678-linux-cryptography-and-security-engineer.md) This is a unique opportunity to use your software engineering and cryptography skills to build and maintain the security foundation that enables Ubuntu and its users to operate securely and… * ![Latent logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2026/11/c872d1ae22b7-221.webp) Latent Nov 12 New ### [Security Engineer](https://jobicy.com/jobs/161597-security-engineer-7.md) About Latent Latent is the enterprise pharmacy intelligence platform, powered by a clinical agentic engine, that enables health systems to grow their pharmacy operations and serve more patients. One engine… [Browse all jobs](https://jobicy.com/jobs.md)