Senior Application Security Engineer (Burp Suite DAST)

Status: Active - Immediate Need

Location: Remote - U.S. Only

Focus Areas: Burp Suite DAST (Enterprise), Veracode SAST, CI/CD Security Integration, Linux, and Federal Application Security Testing

Overview

At phia we hire talented and passionate people who are focused on collaborative, meaningful work, providing technical and operational subject matter expertise and support services to our partners and clients. phia is seeking a mission-driven Senior Application Security Engineer to act as a dedicated technical partner embedded within a federal financial regulatory agency's application security team.

You will run the enterprise application security testing program - automated dynamic scanning with Burp Suite DAST (formerly Burp Suite Enterprise Edition) - integrate scanning into development pipelines, and work in Linux environments to keep scans healthy. This is a hands-on engineering seat for someone who has operated an enterprise Dynamic Application Security Testing (DAST) program, not only manual testing with Burp Suite Professional.

What You'll Do

• Run Enterprise DAST: Configure, schedule, and run dynamic application security scans with Burp Suite DAST (Enterprise), including authenticated scans across the application portfolio.

• Integrate the Pipeline: Build and maintain scan integrations in development environments and CI/CD pipelines (e.g., Eclipse, JDeveloper, Veracode pipeline scanning).
• Work in Linux: Navigate Linux/UNIX systems and troubleshoot basic website connectivity issues that affect scanning.
• Design Security Controls: Design and implement enterprise-wide security controls for applications, systems, networks, and infrastructure services.
• Apply the Standards: Map findings to OWASP Top 10, CVSS, CWE, WASC, and SANS-25, and align work to NIST 800-53, FIPS, and FedRAMP.

Who You Are

• Enterprise DAST Practitioner: 3+ years running Burp Suite DAST / Burp Enterprise scans - not only Burp Suite Professional.
• Veracode SAST User: 2+ years of Static Application Security Testing (SAST) experience, including Veracode and its pipeline integration.
• Coder: 3+ years with Java, Python, .NET, or C#.
• Linux-Comfortable: 3+ years in Linux/UNIX, including troubleshooting connectivity.
• Controls Designer: You have designed enterprise-wide security controls.
• Federal-Aware: Familiar with NIST 800-53, FIPS, or FedRAMP.

Required Qualifications

• 6+ years of Information Technology experience, with experience in cybersecurity or application security.
• 3+ years of experience with Java, Python, .NET, or C#.
• 3+ years of experience using Burp Suite DAST to perform Dynamic Application Security Testing (DAST).
• 2+ years of experience with Static Application Security Testing (SAST), using tools such as Veracode.
• 3+ years of experience designing and implementing enterprise-wide security controls to secure applications, systems, networks, or infrastructure services.
• 3+ years of experience with Linux or UNIX environments, including system navigation and troubleshooting basic website connectivity issues.
• 2+ years of experience with Veracode and development environments such as Eclipse or JDeveloper, including pipeline development and integration.

• Experience securing enterprise web applications and frameworks, including OWASP Top 10, CVSS, CWE, WASC, and SANS-25.
• Knowledge of federal security and compliance standards, including NIST 800-53, FIPS, or FedRAMP.

Preferred Skills

• Experience with Interactive Application Security Testing (IAST) capabilities and tools.
• Burp Suite DAST experience is pivotal in this position (required)

Required Education + Clearance

• Education: High school diploma or GED required; Bachelor's Degree preferred (Experience can be substituted for education).
• Clearance: Public Trust / Suitability; applicants selected will be subject to a security investigation.

GENERAL PROGRAM REQUIREMENTS:

• Citizenship: Must be a U.S. Citizen. No exceptions.
• Work Hours: Expected 8.5-hour work day (with a 30-minute break) within core hours approximately 7:30 AM - 4:30 PM US Eastern Time (ET), Monday through Friday; daily standup at 8:30 AM ET; schedule is flexible with advance notice.
• Work Location: Fully remote within the United States.
• Travel: Minimal.

Who We Are

phia LLC ("phia") is a Northern Virginia based small business established in 2011 with focus areas of Cyber Intelligence, Cyber Defense, Threat Hunting, Intrusion Analysis & Incident Response, Vulnerability and Risk Management, Cyber Architecture & Engineering, Identity & Access Management, Cyber Policy & Strategy, Information Assurance, Compliance, and Communications, Personnel, and Facilities Security. phia also provides support functions such as: Program and Process Management, Strategic Communications and Engagement, and IT Infrastructure and Application DevSecOps that efficiently integrate our customer's missions and objectives. phia supports various departments, agencies and offices within the U.S. Federal Government and private/commercial entities.

phia offers excellent benefits to enhance work-life balance, including the following:

• Medical Insurance

• Dental Insurance
• Vision Insurance
• Life Insurance
• Short Term & Long Term Disability
• 401k Retirement Savings Plan with Company Match
• Paid Holidays
• Paid Time Off (PTO)
• Tuition and Professional Development Assistance

phia does not discriminate on the basis of race, sex, color, religion, age, national origin, marital status, disability, veteran status, genetic information, sexual orientation, gender identity, or any other reason prohibited by law in the provision of employment opportunities and benefits.