Skip to content
CV Rocket
Get started
How it worksThe enginePricingBlogContactSign in

Open nowPosted 22 days ago

Security Engineer, Application Security

Quartermaster8 open roles

Pay
$180,000 – $210,000 a year
Where
Arlington, VA
Work mode
On site
Get the CV for this job

From $25 per CV, paid once. No subscription.

Your applicationOpen nowSecurity Engineer, Application SecurityQuartermaster · Arlington, VA

  1. YouYes, apply to this one.

  2. CV RocketCV written for this posting.

  3. 25 readersRecruiter, hiring manager, skeptic. Round after round.

  4. CV RocketApplied on Quartermaster's own form.

The reply lands in your private mailbox

3×more interviews than doing it yourself with ChatGPT.

The clock on this job

Early applications get read.

13.3% of postings close within 7 days. Measured by our own scanner across the market. Quartermaster postings stay open a median of 27 days.

Share of postings closed within
  1. 2.1%1 day
  2. 4.6%3 days
  3. 13.3%7 days
  4. 21.3%14 days
  5. 35.7%30 days
  6. 59.1%60 days
This job: posted 22 days ago

Quartermaster median: 27 days open

The posting

ABOUT QUARTERMASTER AI

At Quartermaster AI, we believe the ocean should be a safe and sustainably managed resource for all. By leveraging cutting-edge AI and robotics, we unlock capabilities that were only recently impossible. Our distributed open-ocean systems enable every vessel to sense, compute, and communicate, enhancing maritime domain awareness for those who need it most.

The software we ship runs in contested environments and on systems our partners stake their missions on. We need an application security engineer who can build security into our products from the first design review to the last line of code — making secure the easy, default path for every engineer on the team.

THE ROLE

As our Security Engineer, Application Security, you will own the security of the software we build — our cloud services, APIs, data pipelines, and the applications that run across our distributed, edge-deployed systems. You will be the security partner engineering teams turn to: leading threat models and design reviews, finding and helping fix vulnerabilities in code, and steering the architecture of our products toward secure-by-default.

This is a hands-on senior role with broad autonomy. You’ll go deep on code and architecture, build the tooling and automation that scales application security across a fast-moving engineering org, and raise the security bar through developer enablement rather than gatekeeping. You will work closely with Engineering, our security operations team, and GRC, and help shape the secure software development lifecycle as the company grows.

KEY RESPONSIBILITIES

- Lead threat modeling and secure design reviews for new and existing services, identifying and mitigating risk early in the development lifecycle.

- Perform in-depth secure code reviews and full-scope application security assessments — whitebox, greybox, and blackbox — across web, API, cloud, and backend services.

- Build, integrate, and tune application security tooling in CI/CD — SAST, DAST, SCA, secret scanning, and static analysis platforms such as CodeQL — to catch vulnerabilities before they ship.

- Triage, prioritize, and drive remediation of application vulnerabilities together with engineering teams, ranking work by real-world risk and business impact.

- Develop automation and paved-road tooling that eliminate entire classes of weaknesses and make the secure path the default path for developers.

- Serve as the application security subject-matter expert for engineers and architects, steering product design toward secure-by-default patterns.

- Define and mature the secure software development lifecycle (SDLC), secure coding standards, and security requirements across the engineering organization.

- Own or support the vulnerability disclosure and bug bounty process — scoping, validating submissions, performing root-cause analysis, and coordinating fixes with engineering.

- Strengthen software supply chain security, including dependency management, artifact and commit signing, and build/pipeline integrity.

- Partner with the security operations team on application-layer incidents, providing code-level expertise during investigation and remediation.

- Deliver developer-focused security training and champion a security-aware engineering culture through enablement rather than gatekeeping.

REQUIRED QUALIFICATIONS

- 5–8 years in application security, product security, or software engineering with a strong security focus.

- Software development experience in one or more modern languages (e.g., Python, Go, Java, JavaScript/TypeScript, Rust, or C/C++) and the ability to read and reason about production code.

- Demonstrated experience evaluating code for vulnerabilities and weaknesses, and leading threat modeling and security design reviews.

- Hands-on experience with application security tooling — SAST, DAST, SCA, and static analysis platforms such as CodeQL — and integrating them into CI/CD pipelines.

- Strong understanding of the OWASP Top 10 (web and API), CWE, common vulnerability classes, and secure coding practices.

- Experience securing modern architectures — microservices/SOA, REST/gRPC APIs, containers, and cloud environments (AWS, Azure, or GCP).

- Experience performing black-box and grey-box testing of web applications and APIs.

- Proven track record driving vulnerability remediation by partnering with engineering teams rather than blocking them.

- Excellent written and verbal communication skills, with the ability to influence engineers and explain risk to both technical and non-technical audiences.

- Must be a U.S. citizen.

- Bachelor’s degree in Computer Science, Cybersecurity, or equivalent hands-on experience.

PREFERRED QUALIFICATIONS

- Active U.S. security clearance, or eligibility and willingness to obtain and maintain one.

- Industry certifications such as OSCP, OSWE, GWAPT, GWEB, CSSLP, or Burp Suite Certified Practitioner.

- Experience building “paved road” / secure-by-default frameworks and developer self-service security tooling.

- Experience with software supply chain security (SLSA, in-toto, Sigstore) and artifact/commit signing.

- Experience with infrastructure-as-code and cloud-native security (Terraform, Kubernetes).

- Contributions to bug bounty programs, published CVEs, security research, or open-source security tooling.

- Familiarity with securing embedded, edge, or robotics/IoT software.

- Familiarity with defense-sector compliance frameworks (NIST 800-171, CMMC) as they relate to secure development.

- Prior experience in a startup, defense, intelligence, or critical-infrastructure environment.

WHY JOIN QUARTERMASTER AI?

- Build application security from the ground up for a company defending critical maritime and national-security infrastructure.

- Work with cutting-edge AI and robotics systems in real-world, high-stakes environments.

- Significant autonomy to shape the secure SDLC, tooling, and standards the entire engineering org builds on.

- Competitive salary with comprehensive medical, dental, and vision benefits.

- Flexible remote work with a mission-driven, fast-moving team.

- Career growth in a rapidly scaling defense-tech company at the forefront of maritime AI.

From $25, paid onceGet the CV for this job

What happens when you press

One press. We do the rest.

  1. A CV for this posting

    Written against Quartermaster's own wording, from every piece of relevant proof in your profile.

  2. 25 readers review it

    Recruiter, hiring manager, skeptic and more read every draft, round after round. You get the best round.

    The review screen in CV Rocket: how each CV was read, round by round.

  3. We apply on Quartermaster's form

    Our application engine gets through the hardest forms there are. Where a question needs you, AI suggests the best answer. Don't want us applying from our IP addresses? Use our Chrome extension: we apply straight from your own browser.

    An application in CV Rocket: every answer filled in on the employer's form.

  4. Every reply, sorted

    Quartermaster's answer lands in your private mailbox, and we classify it on arrival: interview, question, rejection.

    The CV Rocket inbox: each employer reply classified as an interview, an action or a rejection.

  5. Reply with AI

    AI helps you write the email, checks it and sends it. We show you whether the recruiter read it.

  6. The interview in your calendar

    Full integration with your calendar. The invitation goes straight in.

    An interview invitation in the CV Rocket inbox, added to the candidate's calendar.
Get the CV for this job

From $25 per CV, paid once. No subscription.

Why it works

3×

more interviews than doing it yourself with ChatGPT.

ChatGPT writes a CV and never learns what happened to it. We see every reply. For each CV we know:

  • How it was written, and how the review scored it
  • When we applied, and how long after the posting went up
  • Which posting, which company, which city
  • Who got the interview, and who heard nothing

That is how we know which CVs get called.

Get the CV for this job

From $25 per CV, paid once. No subscription.

The numbers game

More applications. More interviews.

Every application goes out with its own CV, written for that posting and paid once. Send enough of them and the law of large numbers finds you the job.

Get the CV for this job
By hand5–10
With CV Rocket100
applications a day

Nearby

Live postings like this one

Same employer first, then the same role elsewhere.

Before you press

Straight answers

Get the CV for this job

From $25 per CV, paid once. No subscription.

What if my background isn't good enough?

We make the most of the background you have. The CV uses every piece of relevant proof your profile holds, and one of the 25 readers reads your whole profile and flags what the CV left out.

Do you really apply for me?

Yes, on the employer's own form, the hardest ones included. Where a question needs you, you answer it right there and AI suggests the best answer. Don't want us applying from our IP addresses? Use our Chrome extension: we apply straight from your own browser.

Is it a subscription?

No. You pay once per CV, from $25. Every application goes out with its own CV, written for that posting.

One job. One CV.
Paid once.

Pick the posting you want. We write for it, apply for you and catch the reply.

Get the CV for this job

From $25 per CV, paid once. No subscription.