Senior Cybersecurity Engineer, Applications

Location: Rockville, MD, United States; hybrid workplace with a traditional office environment, occasional telework, and local travel among offices as needed.

Annual base salary: $101,400–$154,650, with potential discretionary or non-discretionary bonus.

Company

hirify.global develops life sciences diagnostic technologies and operates in a regulated environment.

What you will do

• Analyze, investigate, respond to, and recover from cybersecurity incidents, events, and threats.
• Remediate application vulnerabilities and guide engineering and development teams on preventative security measures.
• Integrate static analysis, dynamic analysis, and software composition analysis into software development and deployment pipelines.
• Conduct threat modeling, secure design reviews, and architecture reviews, and represent security in the Change Advisory Board.
• Assess and improve the security of AWS application workloads and containerized platforms, including Kubernetes environments.
• Coordinate external application penetration testing, engineer security solutions, maintain security tools and procedures, and report security metrics.

Requirements

• Bachelor’s degree in MIS, computer science, computer engineering, or a related field with a cybersecurity concentration, or an equivalent combination of education and relevant experience.
• At least 5 years of relevant cybersecurity experience, including demonstrated depth in application or software security. Broader cybersecurity experience is valued.
• Knowledge of secure coding practices, software supply chain risk, dependency management, and artifact repository controls.
• Working knowledge of OWASP resources, including the Top 10 and Application Security Verification Standard, with hands-on experience using static analysis, dynamic analysis, and software composition analysis tools.
• Experience securing applications built on Java or .NET, with familiarity with the development practices and common weaknesses of at least one of these stacks.
• Knowledge of API security, authentication and authorization technologies including SSO, OAuth, OIDC, and SAML, and session management practices.
• Working knowledge of Amazon Web Services and cloud security controls for application workloads, including container and Kubernetes security.
• Knowledge of network, web server, and database security, web application firewall concepts, malware analysis, and incident response.
• Knowledge of security standards, access controls, compliance requirements, data classification, encryption, DLP, and secrets management for credentials in code and pipelines.
• Ability to create, maintain, and report metrics measuring the effectiveness of security controls.
• Self-directed, hands-on, collaborative approach with ownership of security initiatives and the ability to drive them to completion with minimal supervision.
• Effective communication, a positive and confident attitude, and excellent writing skills for well-formatted reports and customer-facing documentation.

Nice to have

• Life sciences experience.
• Experience working in regulated or validated environments is strongly desired.
• Industry certification such as GWAPT, GWEB, OSWE, CSSLP, OSCP, or CISSP.
• Experience with ISO 27001 or the NIST Cybersecurity Framework.
• Scripting and automation skills in Bash, Python, PowerShell, or similar technologies.

Culture & Benefits

• Hybrid work with occasional telework in a traditional office environment.
• Medical, dental, vision, prescription, flexible spending, and employee assistance benefits.
• 401(k) plan with company matching, company-paid short- and long-term disability insurance, and group life insurance.
• Paid vacation, sick leave, holidays, and parental leave.
• Additional voluntary benefits include fitness club contributions, pet insurance, identity theft protection, home and auto insurance discounts, and optional supplemental life insurance.