Trusted with solving the complex challenges facing our connected world
Senior AppSec Engineer – Burp Suite, Linux, Custom Extensions
Location
Virginia
Posted
5 days ago
Salary
0
Seniority
Senior
Job Description
Senior AppSec Engineer – Burp Suite, Linux, Custom Extensions
phia, LLC
• Own day-to-day operations of the Burp Suite Enterprise DAST program: scan scheduling, agent and Linux infrastructure health, scan tuning, and result triage across multiple federal application environments. • Configure and troubleshoot authenticated scans against modern web applications and APIs, including recorded login sequences (via the official Burp recorder Chrome extension), session-handling rules, and macro-based re-authentication. • Diagnose and resolve Burp Enterprise scan failures end to end: consecutive audit-item failures, skipped insertion points, timeouts, session invalidation, and authentication state loss. • Extend Burp Suite Professional with custom extensions (Python/Java/Montoya API) to automate repetitive manual verification, custom authentication flows, and findings validation for the bug bounty program. • Design and implement authenticated scan workflows that survive multi-factor authentication, including SMS one-time passwords, TOTP tokens, hardware dongles, PIV and smart card client-certificate authentication, and SSO federation. • Administer the AppSec team’s own Linux infrastructure in AWS (currently EC2 with containerized Burp Enterprise components) and contribute to the migration to on-premise OpenShift. • Convert legacy Python and shell tooling left behind by previous engineers into Ansible roles and playbooks; manage YAML, Dockerfiles, and Kubernetes manifests as code. • Integrate AppSec tooling into GitHub Actions workflows alongside Dependabot SCA, including the appropriate use of workflow_dispatch versus workflow_call patterns and reusable workflows. • Provide secondary support to the broader AppSec toolset: Veracode SAST, Contrast IAST for interactive scanning and runtime security testing, GitHub Advanced Security workflows, and the HackerOne bug bounty program (validating reported findings with Burp Suite Professional).
Job Requirements
- 6+ years of hands-on application security engineering experience.
- Demonstrable, current expertise with Burp Suite Enterprise (DAST operations, scan authentication, troubleshooting) and Burp Suite Professional (manual testing, repeater, intruder, session handling).
- Strong Linux/Unix administration skills from the command line.
- Comfortable answering basic questions like "what command checks disk space" or "how do I check whether a service is running" without hesitation, and equally comfortable with more advanced diagnostics.
- Proficiency writing custom Burp extensions and security automation scripts in Python (and ideally Java for the Montoya API).
- Working experience with Kubernetes, Docker, and YAML-driven infrastructure.
- Experience with AWS CloudFormation (or equivalent IaC) and Ansible.
- Experience integrating security scanning into CI/CD pipelines using GitHub Actions, including reusable workflows and Dependabot.
- Demonstrated experience designing authenticated DAST scans against applications protected by SSO, MFA, OTP, or PIV/smart card authentication.
- Clear understanding of modern authentication and authorization protocols, including OAuth 2.0 flows (authorization-code, client-credentials, refresh tokens), SAML, and OpenID Connect.
- U.S. Citizenship and ability to obtain and maintain the required federal Public Trust clearance.
Benefits
- Fully remote within the United States.
- Standard work day is 8.5 hours with a 30-minute lunch, starting at 8:30 AM EDT with the federal client daily stand-up.
- Hours are flexible around the stand-up and any scheduled client meetings.
- Small team: you will be one of two to three engineers focused on the AppSec work stream, with direct, daily collaboration with the government technical lead.
Related Guides
Related Job Pages
More Full-stack Engineer Jobs
• Manage, mentor, and develop a team of software engineers across all experience levels • Conduct regular 1:1s, provide timely and constructive feedback, and support each engineer’s professional growth and career development • Partner with recruiting to grow the team by attracting and hiring engineers aligned with the team’s AI-native technical direction • Set clear expectations, foster accountability, and build a culture of trust, collaboration, and continuous improvement • Address performance issues constructively and proactively • Own the team’s delivery commitments; ensure features, bug fixes, and technical investments are completed on time and meet quality standards • Participate in sprint planning, backlog refinement, and prioritization discussions with Product and stakeholders • Remove blockers, manage dependencies, and ensure the team has what it needs to execute effectively • Monitor and continuously improve team velocity, predictability, and delivery health within the agentic pod model • Maintain strong technical engagement: participate in architecture discussions, code reviews, and technical planning • Ensure the team adheres to engineering standards for C# / .NET, API design, database patterns, front-end development, and CI/CD using Azure DevOps • Identify and address technical debt; champion sustainable engineering practices • Drive adoption and effective use of AI-assisted development tools (GitHub Copilot, Claude, Azure OpenAI) across the team; ensure engineers are working in an agentic delivery rhythm where AI handles generation at scale and engineers own judgment, quality, and architectural decisions • Partner with other engineering leaders to define and uphold organizational AI development standards, prompt engineering practices, and AI output review requirements • Track and evaluate team-level engineering metrics, including sprint velocity and predictability, CI/CD pipeline health, production incidents, defect backlog trends, and system performance data to identify systemic issues and drive continuous improvement • Use data to communicate engineering health, technical decisions, tradeoffs, and statuses clearly to stakeholders and leadership • Contribute to engineering-wide initiatives including hiring practices, standards, tooling, and process improvement
• Design and implement full-stack features using C# / ASP.NET Core, Entity Framework Core, and SQL Server / Azure SQL for back-end services, and React or Angular for front-end applications • Write well-tested, maintainable code with unit and integration tests • Participate actively in code reviews, providing and incorporating constructive feedback • Contribute to Azure DevOps CI/CD pipelines and deployment workflows • Troubleshoot and resolve production issues in a timely manner • Use AI-assisted development tools (GitHub Copilot, Claude) with structured, context-rich prompts to accelerate coding, test coverage, and documentation • Critically evaluate all AI-generated output before committing — review for correctness, security risks, and alignment with team architecture and coding standards • Work within Libra’s agentic engineering model: AI agents handle code generation at scale; engineers own the judgment, quality bar, and architectural decisions on everything that ships • Collaborate with Product, QE, business stakeholders, and peers to deliver features that meet acceptance criteria and quality standards • Partner with offshore developers on the squad to scope tasks clearly, provide code review feedback, and maintain shared quality standards
Software Engineer
Salvo HealthEnabling GI providers and hospital systems with tech-powered whole patient care, to reinvent the future of healthcare.
• Contribute to the development of our web, mobile, and backend applications. • Partner with Product and Design to guide the direction of our products, integrations, and technology. • Integrate third-party technologies including medical devices and EHRs into our platform. • Use cutting-edge generative AI techniques to build intelligence into our clinical platform.
Senior Software Engineer – Maintenance, Dev Support
RenWe provide the technology and service so donors can focus on giving and organizations can focus on growth.
• Act as a team advisor and technical thought leader, guiding direction and execution of high-impact initiatives within the domain. • Own complex production issues end-to-end, from triage through resolution, driving sustainable fixes and prevention strategies. • Lead root-cause analysis (RCA) across application, API, and database layers. • Design and implement maintainable, scalable, and testable solutions for defect resolution and system improvements. • Originate and institutionalize best practices, standards, and methodologies that improve engineering effectiveness and platform reliability. • Balance short-term fixes with long-term architectural integrity and maintainability. • Solve highly complex, cross-domain problems using advanced technical knowledge and broad experience. • Diagnose and optimize system performance across frontend, backend, and database layers. • Analyze Oracle database performance, including SQL optimization and execution plan tuning. • Lead technical debt reduction initiatives, prioritizing work that delivers meaningful improvements to system health and developer productivity. • Introduce new tools, approaches, or patterns that elevate operational efficiency and platform resilience. • Develop and maintain solutions in TypeScript/React and C#/.NET Core services. • Write and maintain automated unit and integration tests to reduce defects and prevent regression. • Refactor legacy code to improve clarity, maintainability, and performance. • Ensure adherence to secure coding practices and enterprise standards. • Build strong relationships and influence stakeholders across engineering, product, and operations through clear communication of complex concepts. • Translate deep technical issues into actionable insights for cross-functional partners. • Provide mentorship and guidance to engineers, actively developing team capabilities and avoiding common pitfalls. • Contribute to a culture of continuous improvement, intellectual humility, and engineering excellence. • Own incoming operational requests during business hours and drive timely resolution. • Create and maintain runbooks, documentation, and training materials to improve response consistency and reduce operational friction. • Collaborate closely with Operations, Product, and other stakeholders to ensure issues are properly prioritized and understood within business context. • Utilize observability tools (e.g., Application Insights, Datadog) to proactively monitor and improve system performance. • Leverage AI-assisted tools and agents to accelerate triage, debugging, and root-cause analysis workflows. • Design, build, and maintain AI-enabled developer tooling (e.g., MCP servers, diagnostics automation) to improve team productivity. • Establish responsible AI usage practices, ensuring outputs are validated, explainable, and aligned with engineering standards.



