Back to jobs

Application Security Engineer

Remote

Vannevar builds AI systems for the Department of War's most consequential missions. We have 125 deployments across every branch and combatant command spanning our core platform and five distinct products. An an example of how we work, when major combat operations started with Iran, we fielded a new product supporting 24/7 operations and 9,000+ users in three months.

How we build is our advantage: we deploy forward with the people who own the mission. Our engineers, product team, and CTO deploy forward to the point of friction, including visiting units in Ukraine. We focus on embedding directly with operational units supporting great power competition with China, combat operations with Iran, and counter-narcotics missions.

About the role

As an Application Security Engineer, you will help build security into our SaaS platform, ensuring we can quickly ship secure features to our customers. You will partner with software, DevOps, and platform teams, while coordinating with audit partners, to embed threat modeling, automated SAST/SCA/DAST, and rapid vulnerability response into every stage of our SDLC. Your work will be pivotal in protecting customer data, meeting compliance milestones, and scaling our security posture as the company grows.

What you'll do

  • Implement and deploy enterprise standard SAST, SCA, secrets-scan, DAST, and container/IaC checks in CI/CD
  • Embed with development teams to run threat models, review critical PRs, and coach secure-by-default habits.
  • Drive a shift-left vulnerability detection program to identify and remediate vulnerabilities earlier in the software development lifecycle (SDLC).
  • Coordinate with DevOps for application security issues that cross between application and infrastructure layers
  • Support incident-response for product issues and feed lessons back into code, docs, and process.

What you should have

  • 5 + years in Application / Product Security
  • Hands-on experience securing web applications and automating AppSec workflows.
  • Familiarity with DevSecOps practices and container security & patching
  • Experience with GitHub Actions, Python, TypeScript/JavaScript
  • Clear, concise communicator who can translate risk for engineers

Nice to have

  • Experience securing LLM workflows
  • Experience with NIST Risk Management Framework
  • Experience with software security at a U.S. defense contractor
  • Active Security Clearance (or ability to obtain one) and willingness to travel onsite

Benefits:

  • Health, dental, and vision insurance
  • 100% remote - work from anywhere in the US
  • 401k matching
  • Mental benefits
  • Flexible work environment - you manage your workday
  • Pet and child care reimbursement during travel
  • Unlimited PTO
Compensation
The salary range for this position is $160,000 - $210,000 + equity + 401K match. Within the range, individual pay is determined by experience, relevant education, and/or training.

 

Vannevar is an equal opportunity employer, and qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender perception or identity, national origin, age, marital status, protected veteran status, or disability status.
 
We encourage candidates from all backgrounds to apply, even if you don't feel like you're a perfect fit. If you're passionate about contributing to our mission, we'd love to hear from you!
 
IMPORTANT NOTICE
We are committed to protecting the privacy of all applicants. Official emails from the company will come from an @vannevarlabs.com domain. Under no circumstances will a legitimate representative from our company contact you to request passwords, financial information, or other sensitive personal data. Please be vigilant of potential scams.

Create a Job Alert

Interested in building your career at Vannevar? Get future opportunities sent straight to your email.

Apply for this job

*

indicates a required field

Resume/CV*

Accepted file types: pdf, doc, docx, txt, rtf

Cover Letter

Accepted file types: pdf, doc, docx, txt, rtf

Select...

To conform to U.S. Government space technology export regulations, including the International Traffic in Arms Regulations (ITAR) you must be a U.S. citizen, lawful permanent resident of the U.S., protected individual as defined by 8 U.S.C. 1324b(a)(3), or eligible to obtain the required authorizations from the U.S. Department of State. Learn more about ITAR here.

Select...

We support remote workers in the US only. Do you currently reside in the US and plan on staying for the next twelve months? 

Select...
Select...

Please tell us how you heard about this opportunity.

Voluntary Self-Identification

For government reporting purposes, we ask candidates to respond to the below self-identification survey. Completion of the form is entirely voluntary. Whatever your decision, it will not be considered in the hiring process or thereafter. Any information that you do provide will be recorded and maintained in a confidential file.

As set forth in Vannevar’s Equal Employment Opportunity policy, we do not discriminate on the basis of any protected group status under any applicable law.

Select...
Select...
Race & Ethnicity Definitions

If you believe you belong to any of the categories of protected veterans listed below, please indicate by making the appropriate selection. As a government contractor subject to the Vietnam Era Veterans Readjustment Assistance Act (VEVRAA), we request this information in order to measure the effectiveness of the outreach and positive recruitment efforts we undertake pursuant to VEVRAA. Classification of protected categories is as follows:

A "disabled veteran" is one of the following: a veteran of the U.S. military, ground, naval or air service who is entitled to compensation (or who but for the receipt of military retired pay would be entitled to compensation) under laws administered by the Secretary of Veterans Affairs; or a person who was discharged or released from active duty because of a service-connected disability.

A "recently separated veteran" means any veteran during the three-year period beginning on the date of such veteran's discharge or release from active duty in the U.S. military, ground, naval, or air service.

An "active duty wartime or campaign badge veteran" means a veteran who served on active duty in the U.S. military, ground, naval or air service during a war, or in a campaign or expedition for which a campaign badge has been authorized under the laws administered by the Department of Defense.

An "Armed forces service medal veteran" means a veteran who, while serving on active duty in the U.S. military, ground, naval or air service, participated in a United States military operation for which an Armed Forces service medal was awarded pursuant to Executive Order 12985.

Select...