{"id":3893790,"url":"https://alion.io/job/leidos-application-security-engineer-2","title":"Application Security Engineer","company":{"id":7791,"name":"Leidos","domain":"leidos.com","url":"https://alion.io/company/leidos","size_band":"5000+","is_staffing_agency":false,"employer_type":"services","is_intermediary":false,"listed_via":null,"ats_vendor":"Workday","truth_index":{"grade":"B","score":77,"open_postings":309,"ghost_share":0.003,"stale_share":0.89,"repost_share":0.01,"time_to_fill_p50_days":28,"computed_at":"2026-11-06T05:58:05Z"}},"role":"Security","role_family":"Security","seniority":"middle","employment_type":"full_time","work_mode":"hybrid","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Omaha, United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":{"min":87100,"max":157450,"currency":"USD","period":"year","gross":null,"usd_annual":157450},"salary_estimate":null,"experience_years_min":4,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Agile","optional":false},{"name":"Confluence","optional":false},{"name":"CVSS","optional":false},{"name":"CWE","optional":false},{"name":"Git","optional":false},{"name":"JavaScript","optional":false},{"name":"Jira","optional":false},{"name":"OWASP Top 10","optional":false},{"name":"C++","optional":true},{"name":"Checkmarx","optional":true},{"name":"CI/CD","optional":true},{"name":"EPSS","optional":true},{"name":"Fortify","optional":true},{"name":"Gradle","optional":true},{"name":"Java","optional":true},{"name":"JFrog Xray","optional":true},{"name":"KEV","optional":true},{"name":"Kubernetes","optional":true},{"name":"Maven","optional":true},{"name":"Mend","optional":true},{"name":"npm","optional":true},{"name":"OWASP Dependency-Track","optional":true},{"name":"PowerShell","optional":true},{"name":"Python","optional":true},{"name":"Rust","optional":true},{"name":"Semgrep","optional":true},{"name":"Sigstore","optional":true},{"name":"SLSA","optional":true},{"name":"Snyk","optional":true},{"name":"SonarQube","optional":true},{"name":"Sonatype Nexus IQ","optional":true},{"name":"Veracode","optional":true}],"status":"live","first_seen_at":"2026-11-06T22:25:59Z","employer_posted_date":"2026-11-06","last_verified_at":"2026-11-07T03:45:27Z","board_verified":true,"closed_at":null,"days_open":0,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":0},"description":"Application Security Engineer\nOmaha, NE\nNo Clearance Required to Start\nMust be able to Obtain a TS/SCI\nThe Defense Sector at Leidos is seeking a talented Application Security Engineer to join our dynamic Agile software teams in Omaha, Nebraska. This opportunity will provide professional growth that is singularly focused on providing world class solutions to our customers in an exciting, collaborative, and inclusive environment. You will be challenged and provided with a tremendous opportunity to expand your skills in a customer-facing, fast-paced, and rewarding environment.\nIn this role, the successful candidate has significant experience in building modern JavaScript-based web applications, including familiarity with multiple frameworks, strong programming fundamentals, and typical web application development and deployment processes, as well as cybersecurity experience. We’re looking for someone who can make risk-based security adjudication decisions, not simply operate vulnerability scanning tools! You must be capable of working on multiple projects at once and seeing them all through to completion, and a self-starter who is able to work through any obstacles to get the job done.\nMost of the work will be on site in Leidos' facility in Omaha, Nebraska. Some level of remote/work from home is possible.\nPrimary Responsibilities:\nIndependently evaluate software dependencies, assess risk, approve or reject components, and document defensible technical decisions.\nApply your knowledge of SBOMs, transitive dependencies, component provenance, vulnerability intelligence, and artifact integrity in order to improve software supply chain security.\nEvaluate vulnerabilities in the context of actual application use, rather than relying solely on automated scan results or CVSS scores.\nWork directly with software engineers and DevSecOps teams to resolve security findings without unnecessarily impeding development velocity.\nUse Jira, Confluence, Nexus, Git, development operations, collaboration, and source control tools.\nSupport creation and updating of all relevant documentation and specifications for design, development, and testing.\nBasic Qualifications:\nUS Citizen with the ability to obtain and maintain a TS/SCI within 365 days of your start date with Leidos.\nBachelor’s degree with 4+ years of experience or a Master’s degree with 2+ years of experience. Additional experience may be considered in lieu of a degree.\nExperience performing application security assessments, vulnerability analysis, and security risk evaluations across enterprise software applications and development environments.\nExperience evaluating and adjudicating third-party software libraries, open-source components, and external dependencies for security vulnerabilities, licensing concerns, and software supply chain risks.\nWorking knowledge of Software Composition Analysis (SCA), Static Application Security Testing (SAST), and Dynamic Application Security Testing (DAST) methodologies and tools.\nExperience analyzing Common Vulnerabilities and Exposures (CVEs), Common Vulnerability Scoring System (CVSS) scores, and vulnerability intelligence to assess applicability, exploitability, and operational risk.\nUnderstanding secure software development lifecycle (SSDLC) practices, secure coding principles, and application security best practices.\nFamiliarity with software supply-chain security concepts, including dependency management, Software Bills of Materials (SBOMs), artifact integrity, and vulnerability remediation.\nExperience collaborating with software development teams to identify, prioritize, document, and remediate application security findings.\nWorking knowledge of common application security risks and vulnerabilities, including the OWASP Top 10 and CWE classifications.\nAbility to develop technical security assessments, document risk-based adjudication decisions, and communicate findings and recommendations to technical and program stakeholders.\nPreferred Qualifications:\nUS Citizen with an active TS/SCI security clearance.\nExperience supporting application security activities within DoD, Intelligence Community, or other highly regulated and security-sensitive software development environments.\nExperience with modern software development (Java, Python, Javascript, Rust, etc).\nExperience implementing or managing third-party library approval and adjudication processes, including evaluation of component provenance, known vulnerabilities, transitive dependencies, licensing restrictions, and available mitigation strategies.\nHands-on experience with SCA and vulnerability management tools such as Sonatype Nexus IQ, JFrog Xray, Black Duck, Snyk, Mend, Dependency-Track, or equivalent platforms.\nExperience with application security testing tools such as Fortify, Checkmarx, Veracode, Semgrep, SonarQube, or equivalent technologies.\nExperience generating, analyzing, and maintaining SBOMs using industry-standard formats such as CycloneDX and SPDX.\nFamiliarity with software supply chain security frameworks and guidance, including NIST SP 800-218 (SSDF), NIST SP 800-53, NIST SP 800-161, and relevant CISA guidance.\nExperience assessing vulnerability exploitability and prioritizing remediation using VEX, CISA Known Exploited Vulnerabilities (KEV), EPSS, and other threat intelligence sources.\nExperience integrating automated security scanning, dependency analysis, and compliance checks into CI/CD pipelines and DevSecOps workflows.\nExperience securing containerized applications, container images, and Kubernetes-based deployment environments.\nUnderstanding of software artifact repositories, package managers, and dependency ecosystems such as Maven, Gradle, npm, NuGet, PyPI, and Cargo.\nExperience evaluating software component provenance, artifact signing, integrity verification, and build-pipeline security using technologies such as Sigstore, SLSA, or equivalent approaches.\nAbility to evaluate vulnerability findings in the context of actual application architecture, runtime behavior, and operational exposure to distinguish exploitable risks from false positives or non-applicable findings.\nExperience developing security policies, risk acceptance criteria, vulnerability exception processes, and documented mitigation strategies.\nExperience with Risk Management Framework (RMF), Authority to Operate (ATO) processes, and security control assessment activities.\nExperience scripting or automating security analysis workflows using Python, PowerShell, Bash, or similar technologies.\nFamiliarity with secure development practices for Java, C/C++, Rust, JavaScript, or other enterprise programming languages.\nRelevant industry cybersecurity certifications such as CISSP, CSSLP, Security+, or GIAC GWEB.\nExperience with USSTRATCOM Nuclear Planning process.\nDABAOPP1\nIf you're looking for comfort, keep scrolling. At Leidos, we outthink, outbuild, and outpace the status quo - because the mission demands it. We're not hiring followers. We're recruiting the ones who disrupt, provoke, and refuse to fail. Step 10 is ancient history. We're already at step 30 - and moving faster than anyone else dares.\nOriginal Posting:\nNovember 6, 2026For U.S. Positions: While subject to change based on business needs, Leidos reasonably anticipates that this job requisition will remain open for at least 3 days with an anticipated close date of no earlier than 3 days after the original posting date as listed above.\nPay Range:\nPay Range $87,100.00 - $157,450.00The Leidos pay range for this job level is a general guideline only and not a guarantee of compensation or salary. Additional factors considered in extending an offer include (but are not limited to) responsibilities of the job, education, experience, knowledge, skills, and abilities, as well as internal equity, alignment with market data, applicable bargaining agreement (if any), or other law.","description_format":"text","description_chars":7888,"description_truncated":false,"requirements":{"experience_years_min":4,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":true,"languages":[]},"benefits":["Equity"],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Application Security","National Security","C4ISR","Engineering Services"],"lifecycle":[{"event":"open","at":"2026-11-06T22:25:59Z"}],"visa":[{"country":"US","licensed_sponsor":true,"adverts_offering_sponsorship_24m":0,"sanctioned_now":false,"evidence":"H-1B filings in 12 months: 50 · green card filings: 24","filings_12m":50,"filings_prev_12m":58,"green_card_filings_12m":24,"median_offered_wage_usd":124257,"route":null,"cap_exempt":false,"checked_at":"2026-11-06T22:30:08+00:00","sources":["US Department of Labor: LCA disclosure data (H-1B, H-1B1, E-3)","US Department of Labor: PERM disclosure data (green cards)"],"filings_for_role_12m":4}],"liveness":{"score":86,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.86,"p_room":1,"age_days":0,"expected_fill_days":28,"reasons":["conf:0","win:early","comp:brand"],"computed_at":"2026-11-07T04:41:23Z"},"pay":{"stated_usd_annual":157450,"is_top_pay":true},"html_url":"https://alion.io/job/leidos-application-security-engineer-2","json_url":"https://alion.io/job/leidos-application-security-engineer-2.json","meta":{"generated_at":"2026-11-07T04:41:23Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":11421,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-08T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":7791},"rest":"https://alion.io/mcp/rest/get_company?id=7791"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fleidos-application-security-engineer-2"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fleidos-application-security-engineer-2"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fleidos-application-security-engineer-2"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/leidos-application-security-engineer-2\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fleidos-application-security-engineer-2"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":3893790}},{"tool":"search_jobs","arguments":{"company":"leidos.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":3893790},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}