Bachelor's degree in computer science, Cybersecurity, Software Engineering, or related field
Minimum of 8 years' experience in software development, cybersecurity, or related roles
At least 8 years of hands-on experience in open-source software security
Demonstrated experience in developing, testing, and contributing to production software and open-source projects
Knowledge of secure development practices and software supply chain security
Experience with AI-assisted development or security tools
Strong communication skills for cross-team collaboration
Responsibilities
Support CISA's Secure by Design initiatives and engage with open-source organizations and vendors
Use AI-assisted tools to identify, analyze, and recommend remediation for OSS vulnerabilities
Assess existing vulnerabilities and identify opportunities for software hardening
Provide technical guidance on dependency management and software supply chain risks
Translate CISA guidance into tools and contributions for open-source projects
Contribute code, testing, and documentation to an open-source coding agent
Collaborate with various technical teams and participate in community engagements
Benefits
US citizenship with ability to obtain and maintain DHS Suitability (EOD)
Full Job Description
Everforth ECS is seeking a Open-Source Software Security SME to join our team in Arlington, VA (Hybrid).
ECS is seeking an Open-Source Software (OSS) Security Subject Matter Expert to support the Cybersecurity and Infrastructure Security Agency (CISA). This role will strengthen open-source software security through vulnerability analysis, hands-on software development, and collaboration with technical teams and the open-source community. This is a hybrid position.
Key Responsibilities
Support CISA's Secure by Design initiatives and engagement with open-source organizations, maintainers, and vendors.
Use AI-assisted tools to identify and analyze OSS vulnerabilities, validate findings, and recommend remediation.
Assess existing vulnerabilities and identify opportunities for software hardening and modernization.
Provide technical guidance on dependency management, Software Bills of Materials (SBOMs), and software supply chain risks.
Translate CISA guidance into working tools and software contributions suitable for acceptance into active open-source projects.
Contribute code, testing, and documentation to an open-source coding agent used as a reference implementation.
Collaborate with vulnerability management, threat hunting, AI, product, and platform engineering teams.
Participate in technical pilots and open-source community engagements.
Salary Range: $185,000 - $235,000
General Description of Benefits
US citizenship with ability to obtain and maintain DHS Suitability (EOD).
Bachelor's degree in computer science, Cybersecurity, Software Engineering, or related technical field
Minimum of 8 years' professional experience in software development, cybersecurity, or related technical roles
At least 8 years of hands-on experience in open-source software security, application security, or vulnerability research
Experience in open-source software security, vulnerability analysis, and software development.
Demonstrated experience developing, testing, and contributing code to production software systems, and open-source projects.
Knowledge of secure development practices, dependency management, SBOMs, and software supply chain security.
Experience using AI-assisted development or security tools and validating their results.
Strong communication skills and ability to work across technical teams.
About ECS
ECS is a leading provider of digital solutions and services to the federal government. The company was founded in 2001 by Roy Kapani and has since grown to become a trusted partner to a wide range of government agencies. ECS offers a broad range of services, including cloud computing, cybersecurity, and artificial intelligence. The company has been recognized for its innovative solutions and has won numerous awards, including the AWS Public Sector Partner of the Year award.
