Software Secuirty Engineer - TS/SCI Clearance

Description
Position Overview We are seeking a cleared Software Security Engineer with a strong software engineering background and practical knowledge of U.S. government cybersecurity requirements. This hands-on role will review source code, application designs, and software security testing results to assess whether applications meet applicable government security criteria. The engineer will translate security requirements into actionable development guidance, work directly with developers to remediate vulnerabilities, and document evidence supporting security assessments and release decisions. This position emphasizes application security and code-level analysis rather than primarily policy administration or network security operations. Key Responsibilities • Perform manual security reviews of source code, pull requests, and application changes to identify vulnerabilities, insecure coding patterns, and deviations from approved security requirements. • Assess application security against the program's approved security baseline, including applicable NIST SP 800-53 controls, NIST Secure Software Development Framework (SP 800-218) practices, agency-specific requirements, and DISA Application Security and Development STIG requirements where required by the customer. • Translate applicable controls and security requirements into code review checklists, testable acceptance criteria, and developer implementation guidance. • Review authentication, authorization, input validation, session management, error handling, audit logging, secrets management, data protection, and cryptographic implementation for secure design and coding practices. • Execute and interpret static application security testing (SAST), dynamic application security testing (DAST), software composition analysis (SCA), and secrets scanning; validate findings and distinguish actionable vulnerabilities from false positives. • Evaluate third-party and open-source dependencies for known vulnerabilities and support software component inventory and software bill of materials (SBOM) activities. • Partner with developers to recommend practical code-level fixes, review remediation changes, and verify closure through retesting and regression testing. • Participate in threat modeling and application architecture reviews to identify security risks early in the software development life cycle. • Integrate automated security checks and defined security gates into continuous integration and continuous delivery (CI/CD) workflows. • Document findings with affected code locations, technical impact, applicable requirements, remediation recommendations, and verification evidence. • Support Risk Management Framework (RMF) assessments and authorization to operate (ATO) activities by providing application security evidence and remediation status to security and compliance stakeholders. • Communicate unresolved risks and release-readiness recommendations to designated decision-makers; escalate exceptions through the approved risk acceptance process. • Help maintain secure coding standards and provide developers with practical guidance to prevent recurring vulnerabilities. Required Qualifications • Active TS/SCI Clearance • Professional software engineering experience developing, testing, debugging, and maintaining production applications, with demonstrated hands-on secure code review or application security experience. • Proficiency in one or more programming languages relevant to the application environment, such as Java, C#, Python, JavaScript/TypeScript, C/C++, or Go, and the ability to understand unfamiliar codebases. • Working knowledge of government security requirements and the ability to apply relevant NIST SP 800-53 controls and NIST SSDF practices to software development and verification. • Ability to interpret customer-specific security requirements and, where applicable, DISA STIG checks and translate them into concrete code changes and validation steps. • Strong understanding of common application vulnerabilities, including injection, broken access control, insecure authentication, insecure deserialization, and sensitive data exposure. • Experience using application security testing tools, validating results through code analysis, and explaining remediation options to developers. • Experience with Git-based version control, peer code review, automated testing, and CI/CD workflows. • Understanding of web application and API security, least privilege, secure handling of credentials, and protection of data in transit and at rest. • Ability to produce clear technical findings and maintain traceability between security requirements, implementation, testing, and remediation evidence. • Bachelor's degree in Computer Science, Software Engineering, Cybersecurity, or a related discipline, or equivalent practical experience. • Experience supporting federal civilian or defense software programs, including application security reviews within RMF or ATO processes. • Hands-on experience applying the DISA Application Security and Development STIG and preparing supporting assessment evidence. • Experience with tools such as Fortify, Checkmarx, CodeQL, Veracode, SonarQube, Snyk, OWASP ZAP, or comparable application security platforms. • Experience with cloud-native applications, containers, infrastructure as code, and software supply chain security. • Familiarity with OWASP Application Security Verification Standard (ASVS), OWASP Top 10, Common Weakness Enumeration (CWE), and risk-based vulnerability prioritization. • Relevant secure software development or application security certifications, such as CSSLP or an equivalent credential. Pay range: 190,000 - $230,000 depending on experience and skill set Benefits overview: https://cdw.benefit-info.com/ Salary ranges may be subject to geographic differentials
* CDW is committed to being an AI-fluent organization
* We're looking for people who bring curiosity, a learner's mindset, and a willingness to engage with ever-evolving technology and tools. We value adopting AI as a partner, openness to experimentation, and a shared interest in learning together on AI. Our goal is to create a culture where AI enhances- not replaces- human creativity and decision-making. You don't need to be an expert today; what matters is your readiness to explore, adapt, and grow with us as we integrate AI responsibly and effectively into our work.Additionally, CDW is committed to fostering an equitable, transparent, and respectful hiring process for all applicants. During our application process, our goal is to understand your experience, strengths, skills, and qualifications. As an AI forward company, we see AI not just as a tool, but as a catalyst for new ways of thinking, creating, and communicating. We encourage candidates to embrace an AI mindset, one that's curious, adaptive, and ready to explore what's possible. We welcome thoughtful use of AI to expand your perspective and elevate how you share your story, while ensuring your application remains rooted in your own background, judgment, and voice.
* About Us
* CDW is a Fortune 500 technology solutions provider that helps businesses, government, education, and healthcare organizations achieve what's possible through technology. What makes CDW different isn't just what we do- it's how we do it. At CDW we act as one- building trust, speaking candidly, and working together to achieve more. We play to win- focusing on what matters most and delivering for our customers. And we think forward- staying curious, moving fast, and continuously learning. We believe meaningful work happens when people feel supported, heard, and empowered to contribute. That's why we think of ourselves as coworkers, not just employees- working together to solve complex challenges and deliver real impact for our customers and communities. As a full-stack, full-lifecycle technology partner, CDW brings deep expertise, strong relationships, and broad industry knowledge to help turn ideas into outcomes. When you join CDW, you become part of a collaborative environment where your work matters, your growth is supported, and your contributions help shape what's next. Together, we deliver the full promise of what technology can do.
* Together, we Make Amazing Happen.
* CDW is an equal opportunity employer. All qualified applicants will receive consideration for employment without regards to race, color, religion, sex, sexual orientation, gender identity, national origin, disability status, protected veteran status or any other basis prohibited by state and local law.