Offensive Security in Washington, DC ( Public Trust Tier 2 clearance level is required)

Location: Washington, DC Duration: 5 Years Key Personnel Requirements:

Web Developer Security Engineer who meets the following specific requirements:

Extensive hands-on experience in secure software development, DevSecOps automation, and vulnerability remediation.

Proficiency in logs analysis, file integrity monitoring (FIM), and managing web application firewalls (WAF) to defend against emerging threats.

Minimum of 3 years of experience in Web Application Security , Application Security Engineering (AppSec) or secure software development life cycle (SSDLC)

Proven developing with modern web technologies and frameworks not limited to .NET (C# MVC, WCF), HTML5, CSS3, JavaScript, REST APIs, and SQL

Ability to leverage AI-assisted development tools (e.g., GitHub Copilot, OpenAI API/Codex) and scripting languages (Python, JavaScript/Node.js, Java, React.js, TypeScript) to automate security monitoring and compliance audits

Strong understanding of Open Worldwide Application Security Project (OWASP) Top 10, secure coding standards, and proactive mitigation of common web vulnerabilities.

Experience deploying, tuning, and maintaining Web Application Firewalls (WAFs) solutions tailored to custom-developed applications and traffic patterns.

Strong track record in configuring and managing File Integrity Monitoring (FIM) solutions for web content directories, to detect and alert on unauthorized change.

Familiar with security testing tools such as Wireshark, SIEM, IDS/IPS, NDR, or EDR

Evaluates, recommends, and implements security controls for mobile device solutions and mobile-web interface.

Ability to perform complex risk assessments, analyze cyber threats, and provide remediation guidance for core systems and their dependencies

Proven ability to implement DevSecOps principles, seamlessly integrating security controls throughout the CI/CD pipeline

Experience developing security metrics, managing compliance reporting, and auditing systems against established security baselines

Collaborate effectively across multidisciplinary teams, and work independently as well as in a team

Experience providing Tier II support for security operations and recommending continue security enhancements for existing infrastructure.

Preferred

In-depth experience at Federal cybersecurity frameworks (NIST SP 800-53, FISMA, FedRAMP) authorization process

Proven background in threat modeling, risk assessment, and designing resilient security architecture

Advanced experience implementing secure DevOps/DevSecOps practices, specifically focus on CI/CD pipeline and automating security gates

Knowledge of cloud security AWS and container security (Docker, Kubernetes)

Required Education & Credentials: Bachelor's degree (or higher) in computer science, Cybersecurity, Information Systems, Engineering, or a related field.

The Consultant must have the following current credentials:

Offensive Security:

o OffSec Web Expert (OSWE)

o Offensive Security Certified Professional (OSCP)

These (or their equivalent prior certifications) should have been maintained for a minimum of 5 years. Expired certifications or certifications never used professionally will not be considered