4 jobs found

Tech Summary The IS Consultant IV, Application Security position is a senior hands-on technical role responsible for leading complex application security assessments and advancing secure software development practices across the organization. The consultant will conduct secure code reviews, static and dynamic application security testing, open source component analysis, API and mobile application security assessments, threat modeling, security architecture reviews, vulnerability validation, and remediation guidance. The ideal candidate has advanced software development and application security experience using Java, Python, JavaScript, .NET, Swift, or similar technologies. The candidate should have practical experience with application security testing solutions, penetration testing tools such as Burp Suite or OWASP ZAP, and integrating security controls into CI/CD pipelines. This role requires the ability to independently lead complex assessments, define secure development standards and guardrails, evaluate third party applications, and influence architecture and engineering decisions. The consultant will collaborate with developers, architects, product owners, vendors, security leaders, and executive stakeholders to communicate technical risk clearly and provide actionable remediation recommendations. Experience with cloud native applications, APIs, mobile applications, AI enabled applications, DevSecOps automation, and healthcare or other regulated environments is preferred. Job Summary: In addition to responsibilities listed below, this position is responsible for reviewing application source code for potential security vulnerabilities by performing manual and automated security testing on applications in a running state (DAST); working with DevOps teams to integrate application security services; training DevOps personnel and developers to use application security tools; working one-on-one with developers to help them understand security vulnerabilities at hand and to identify/suggest remediation plans; and recommending application security training paths. This also includes responsibility for protecting applications in production by enrolling them for continuous assessment of existing and emerging threats, evaluating web application firewalls; tuning WAF rules; reviewing alerts; and identifying issues as appropriate. Essential Responsibilities: Completes work assignments and supports business-specific projects by applying expertise in subject area; supporting the development of work plans to meet business priorities and deadlines; ensuring team follows all procedures and policies; coordinating and assigning resources to accomplish priorities and deadlines; collaborating cross-functionally to make effective business decisions; solving complex problems; escalating high priority issues or risks, as appropriate; and recognizing and capitalizing on improvement opportunities. Practices self-development and promotes learning in others by proactively providing information, resources, advice, and expertise with coworkers and customers; building relationships with cross-functional stakeholders; influencing others through technical explanations and examples; adapting to competing demands and new responsibilities; listening and responding to, seeking, and addressing performance feedback; providing feedback to others and managers; creating and executing plans to capitalize on strengths and develop weaknesses; supporting team collaboration; and adapting to and learning from change, difficulties, and feedback. Effectively communicates investigative findings to non-technical audiences. Collaborates with technology risk teams and business stakeholders to respond to and remediate identified issues, and determine the best approach for improving security posture. Provides recommendations to management and business stakeholders on how to remediate issues identified through security testing processes. Identifies the impact of security test plans on upstream and downstream solution components. Supports information sharing and integration procedures across cyber security through the exchange of threat intelligence and cyber security vulnerability assessment data. Contributes to cyber security intellectual capital by making process or procedure improvements, conducting brown bag training sessions, and creating new training documents. Follows established processes to ensure KPI goals are obtained and performance metrics are tracked on an ongoing basis. Recommends business line or business technology team security process improvements which align with sustainable best practices, and the strategic and tactical goals of the business. Supports continuous process improvement by participating in the development, implementation, and maintenance of standardized security tools, templates, and processes across multiple business domains. Performs complex security test data analysis in support of security vulnerability assessment processes, including root cause analysis. Serves as an escalation point on issues, dependencies, and risks related to security testing. Executes the vulnerability assessment and penetration testing plan, methodologies, and standard processes for moderately to highly complex technology initiatives across multiple IT domains by analyzing business and technology requirements. Researches and stays abreast of industry trends, emerging threats, best practices, and cutting edge techniques to creatively discover and exploit vulnerabilities, and recommend security solutions for technology systems. Provides insight and consultation on the development of testing scope and approach, and collaborates with cross-functional IT and business stakeholders to review the overall testing approach. Validates security test scenarios across various SDLC phases (e.g., development, reproduction, production) for low- to moderately-complex projects. Generates scheduled reports (e.g., status updates, risk assessment reports, remediation reports) and provides regular security metrics to IT teams and management as appropriate. Minimum Qualifications: Minimum three (3) years software or application development experience. Minimum one (1) year experience in application security (e.g., source code analysis, dynamic analysis, etc.). Bachelors degree in Business Administration, Computer Science, Social Science, Mathematics, or related field and Minimum six (6) years experience in IT or a related field, including Minimum two (2) years in information security, network engineering, or application development. Additional equivalent work experience may be substituted for the degree requirement. Additional Requirements:

Secure our Nation, Ignite your Future ManTech is seeking a motivated, career and customer oriented Cyber Threat Analyst to join our team in Springfield, VA to provide unparalleled support to our customer and to begin an exciting and rewarding career within ManTech. Responsibilities include, but are not limited to: Provides leadership and high level CSOC Security Support managing cyber and network incidents and warning activity. Performs security event and incident correlation using information gathered from a variety of sources within the enterprise. Performs cyber incident triage to include determining scope, urgency, and potential impact; identify the specific vulnerability and make recommendations which enable expeditious remediation. Tracks cyber actions from initial detection through final resolution. Analyzes and assesses damage to the data / infrastructure. Performs cyber engineering trend analysis and reporting. Position Requirements: Minimum Education: B.S. or equivalent experience in related field Minimum/General Experience: 8 years of related experience Experience working within a Cybersecurity Operations Center environment desired Experience with COTS technologies used in a Cybersecurity Engineering environment desired CNDSP-A (GCIA, GCIH, or CEH) or CNDSP-IR (GCIH, CSIH, or CEH) certification required IAT Level II (GSEC, Security+, SSCP, or CCNA-Security) certification required Demonstrated technical experience: Proficient in Windows and Linux operating systems. Working knowledge of current COTS Cybersecurity technologies. Working knowledge of database and operating system security. Understanding of latest security principles, techniques, and protocols. Ability to function in a fast-paced environment and effectively manage multiple tasks simultaneously; coordinating resources and ensuring scheduled goals are met. Excellent verbal and written communication skills are required. Ability to effectively interact with various levels of senior management is necessary. Ability to make decisions and resolve problems effectively Seek out information and data to evaluate, prioritize and formulate best solution or practice. Must be able to multi-task, work independently and as part of a team, share workloads, and deal with sudden shifts in project priorities. Clearance Requirement: Must possess an active TS/SCI w/ a Polygraph #LI-MM1 ManTech International Corporation, as well as its subsidiaries proactively fulfills its role as an equal opportunity employer. We do not discriminate against any employee or applicant for employment because of race, color, sex, religion, age, sexual orientation, gender identity and expression, national origin, marital status, physical or mental disability, status as a Disabled Veteran, Recently Separated Veteran, Active Duty Wartime or Campaign Badge Veteran, Armed Forces Services Medal, or any other characteristic protected by law. If you require a reasonable accommodation to apply for a position with ManTech through its online applicant system, please contact ManTech's Corporate EEO Department at (703) 218-6000. ManTech is an affirmative action/equal opportunity employer - minorities, females, disabled and protected veterans are urged to apply. ManTech's utilization of any external recruitment or job placement agency is predicated upon its full compliance with our equal opportunity/affirmative action policies. ManTech does not accept resumes from unsolicited recruiting firms. We pay no fees for unsolicited services. If you are a qualified individual with a disability or a disabled veteran, you have the right to request an accommodation if you are unable or limited in your ability to use or access http://www.mantech.com/careers/Pages/careers.aspx as a result of your disability. To request an accommodation please click careers@mantech.com and provide your name and contact information.