Web Developer Security Engineer

Spry Methods, Inc. is seeking a Web Developer Security Engineer to protect mission-critical web applications and sensitive data by embedding security across the software development lifecycle. The role involves application security engineering, vulnerability remediation, and compliance support.

Responsibilities:

• Identify, analyze, and remediate critical vulnerabilities, logic flaws, insecure dependencies, and misconfigurations in web applications and APIs
• Drive the vulnerability lifecycle through threat modeling, security assessments, and technical validation of remediation actions
• Support secure design patterns, data protection mechanisms, and secure communication protocols across applications and supporting services
• Review and analyze web server and application logs to detect anomalies and indicators of compromise
• Implement automation scripts for threat intelligence integration and application security monitoring
• Participate in audits, risk assessments, and security authorization activities tied to federal frameworks

Requirements:

• Minimum of three years of experience in web application security, application security engineering, or secure software development lifecycle work
• Hands-on experience in secure software development, DevSecOps automation, and vulnerability remediation
• Proven experience with .NET technologies, HTML5, CSS3, JavaScript, representational state transfer (REST) APIs, and structured query language (SQL)
• Ability to leverage AI-assisted development tools and scripting languages to automate monitoring and compliance efforts
• Strong understanding of the Open Worldwide Application Security Project (OWASP) Top 10, secure coding standards, web application firewalls (WAFs), file integrity monitoring, and security testing tools
• Ability to perform risk assessments and provide remediation guidance for core systems and dependencies
• Bachelor's degree or higher in computer science, cybersecurity, information systems, engineering, or a related field
• Ability to meet federal screening and suitability requirements prior to start
• Current security certifications maintained for a minimum of five years: Specialized AppSec: Certified Secure Software Lifecyle Professional (CSSLP), GIAC Certified Web Application Defender (GWEB), EC-Council Certified Application Security Engineer (CASE), Offensive Security: OffSec Web Expert (OSWE), Offensive Security Certified Professional (OSCP), Foundational Security: Security+, GSEC
• In-depth experience with federal cybersecurity frameworks and authorization processes
• Experience with threat modeling, resilient security architecture, cloud security, and container security