Firefly Aerospace
Application Security Engineer – Ground Software
Firefly - Hive · Full-time · Posted Oct 20, 2026
- Experience
- 5+ years of software engineering experience focused on application security.
- Education
- BS in Computer Science, Software Engineering, Cybersecurity, or related technical field.
- Visa sponsorship
- To conform to U.S. Government space technology export regulations, including ITAR, applicants must be a U.S. citizen, lawful permanent resident of the U.S., protected individual as defined by 8 U.S.C. 1324b(a)(3), or eligible to obtain the required authorizations from the U.S. Department of State.
About the job
Secures Firefly’s spacecraft ground software by integrating application security practices, controls, and testing throughout development and deployment.
What you'll do
- Design and maintain security controls; conduct code reviews, software scanning, and vulnerability assessments.
- Integrate SAST/DAST into CI/CD, establish secure coding practices, and work with developers to remediate vulnerabilities.
- Implement secure architectures, access controls, and hardened cloud and container deployments; support security audits and ATO processes.
What they ask for
- Bachelor’s degree in Computer Science, Software Engineering, Cybersecurity, or a related technical field.
- 5+ years of software engineering experience focused on application security.
- Proficiency in React, Node.js, and Python; hands-on experience with vulnerability scanning and application security testing tools.
- Knowledge of secure coding, government security standards, container and cloud security, CI/CD security integration, and authentication, authorization, and encryption; experience in high-reliability, safety-critical, or regulated environments.
Nice to have
- Advanced degree or equivalent hands-on experience in a related technical field; classified or government software experience, ATO involvement, or aerospace ground systems background.
- Incident-response remediation experience, active Secret-or-higher clearance or eligibility to obtain one, or security certifications such as CISSP, CSSLP, CEH, or GIAC.
Tools
React, Node.js, Python, SonarQube, Snyk, Fortify, Veracode, OWASP ZAP
Model-written summary · the original posting is authoritative