Qualifications
Required
Five or more years of professional experience in application security, cloud security, product security, security engineering, or a closely related field
Bachelor's degree in cybersecurity, computer science, information systems, engineering, or a related field. A Certified Information Systems Security Professional (CISSP) credential, or a comparable security certification, together with relevant professional experience will be considered equivalent to the bachelor's degree requirement
Demonstrated experience defining security requirements and reviewing application architectures, data flows, integrations, and technical controls
Experience coordinating SAST, DAST, and penetration testing and validating remediation or retest evidence
Demonstrated experience performing risk analysis and vulnerability triage, developing remediation plans, implementing or supporting technical remediation, and tracking findings to closure
Experience implementing security controls and guiding agency or business personnel on control ownership, operation, evidence, exceptions, and ongoing management
Working familiarity with Jira, Salesforce-based applications, Tenable Cloud, Veracode static and dynamic testing, GitHub, and GitHub Copilot or comparable approved tools
Experience using AI-assisted capabilities responsibly for vulnerability testing, source-code or configuration review, finding analysis, or remediation planning
Working knowledge of identity, data protection, logging, deployment, cloud, and infrastructure controls for complex applications
Experience documenting security findings, residual risk, control decisions, and production-readiness recommendations
Experience coordinating security work across project teams, vendors, shared-service organizations, and managed security service providers
Ability to manage concurrent work against milestones, release schedules, acceptance criteria, and project reporting requirements
Excellent written and verbal communication skills, including the ability to explain technical risks to technical and non-technical stakeholders
Ability to work independently, maintain accurate evidence, and escalate risks or blockers promptly
Preferred
Experience securing AWS, Salesforce, public-facing digital services, or regulated application environments
Experience supporting legacy-platform modernization, cloud re-platforming, or complex application integrations
Experience working with AI solutions and infrastructure, including RAG pipelines, LLM models, or voice models
Familiarity with security considerations for AI-enabled services, document uploads, constituent data, and regulated workflows
Hands-on experience using Jira, Tenable Cloud, Veracode, GitHub, GitHub Copilot, and Salesforce-based applications in an enterprise or public-sector delivery environment
Knowledge of National Institute
