Lead Application Security Engineer

SciTec, a wholly owned subsidiary of Firefly Aerospace, is a dynamic non-traditional defense contractor that delivers advanced technologies in support of U.S. National Security and Defense. For more than forty-five years, we have supported Department of Defense customers by developing innovative remote sensing algorithms, tools, and techniques to deliver world-class data exploitation capabilities supporting missile defense; intelligence, surveillance, & reconnaissance; space domain awareness; and aircraft survivability missions.

• →Bachelor’s degree plus 8+ years of professional experience in cybersecurity or software development, or equivalent experience

• →2+ years of experience focused on application/software security
• →Experience analyzing source code for security flaws
• →Familiarity with secure software development practices
• →Strong analytical and problem-solving skills
• →Detail-oriented with strong written and verbal communication abilities
• →Ability to qualify for and maintain a DoD Secret security clearance
• →Ability to meet DoD 8140.01 Cyberspace Workforce Management requirements within six months of hire
• →Ability to effectively collaborate with government customer team members and other engineers

• Active DoD Secret clearance or higher
• Experience identifying, exploiting, and remediating application vulnerabilities
• Credit for published CVEs is a strong plus
• Proficiency in one or more programming languages such as C++, Python, JavaScript, Rust
• Experience configuring and operating static analysis tools (e.g., Coverity, Klocwork, SonarQube)
• Experience configuring and operating software composition analysis tools (e.g., Snyk, Sonatype, Anchore, JFrog Xray)
• Experience with fuzzing frameworks (AFL, AFL++, honggfuzz, or similar)
• Experience with debugging, runtime instrumentation, or reverse engineering, including tools such as strace, eBPF, Ghidra or IDA Pro
• Familiarity with threat modeling methodologies and frameworks such as MITRE ATT&CK
• Experience working in DevSecOps or Agile development environments