Quartermaster
Security Engineer, Application Security
$180K–$210K
Arlington, VA · On-site · Full-time · Posted Oct 13, 2026
- Experience
- 5–8 years in application security, product security, or software engineering with a strong security focus.
- Education
- Bachelor’s degree in Computer Science, Cybersecurity, or equivalent hands-on experience.
- Visa sponsorship
- Must be a U.S. citizen.
About the job
Own application security for Quartermaster’s cloud services, APIs, data pipelines, and edge-deployed applications by guiding secure design, finding and remediating vulnerabilities, and scaling secure development practices.
What you'll do
- Lead threat modeling, design reviews, and application security assessments; review code and help remediate vulnerabilities.
- Build and integrate security tooling and automation into CI/CD, and mature secure development standards and practices.
- Advise and train engineering teams, support vulnerability disclosure and application-layer incident response, and strengthen software supply chain security.
What they ask for
- 5–8 years in application security, product security, or software engineering with a strong security focus.
- Software development experience in one or more modern languages and ability to assess production code for vulnerabilities; experience leading threat modeling and security design reviews.
- Hands-on experience with SAST, DAST, SCA, static analysis tools such as CodeQL, and CI/CD integration; experience with black-box and grey-box testing.
- U.S. citizenship; bachelor’s degree in Computer Science or Cybersecurity, or equivalent hands-on experience.
Nice to have
- Active U.S. security clearance, or eligibility and willingness to obtain and maintain one.
- Experience with software supply chain security, infrastructure-as-code, cloud-native security, or embedded, edge, or robotics/IoT software.
Pay
USD $180K – $210K base salary
Tools
Python, Go, Java, JavaScript/TypeScript, Rust, C/C++, CodeQL, Terraform
AI focus
No AI development or security work is specified; the posting mentions working with AI and robotics systems.
Model-written summary · the original posting is authoritative