STEM OPT Security Software Engineer Jobs
Security Software Engineer roles qualify for the 24-month STEM OPT extension if your degree falls under an eligible CIP code in computer science, cybersecurity, or a related engineering field. Employers must be enrolled in E-Verify, and you'll need a signed I-983 training plan before your extension starts.
Find STEM OPT Security Software Engineer JobsOverview
Showing 5 of 101+ Security Software Engineer jobs
See all 101+ Security Software Engineer Jobs
Sign up for free to unlock all listings, filter by visa type, and get alerts for new Security Software Engineer roles.
Get Access To All JobsJob Description
We are seeking a Security Software Engineer to build and harden software systems supporting DoD programs operating under CMMC/NIST 800-171/FedRAMP compliance requirements. You will embed security across the SDLC—from design and code review through CI/CD and cloud deployment—working alongside engineering, DevSecOps, and IT teams in a regulated, cloud-native environment (AWS Commercial and GovCloud, Azure GCC High).
Responsibilities
- Core Engineering & Secure Development
- Design and develop secure software with a security-first mindset baked into every phase of the SDLC.
- Apply secure coding standards, threat modeling, and vulnerability mitigation aligned to NIST 800-53 and CMMC Level 2/3 controls.
- Conduct architecture reviews and code hardening to address OWASP Top 10 and DoD STIGs.
- Automate security gates in CI/CD pipelines (SAST, DAST, dependency scanning, secrets detection).
- Security Architecture & Controls
- Design secure system and API architectures for multi-tenant cloud environments, including GCC High and FedRAMP-authorized platforms.
- Implement IAM controls, JIT provisioning, SSO/SAML/OIDC flows, and least-privilege authorization frameworks (e.g., Cognito, Azure AD).
- Instrument applications with security logging and monitoring that satisfies audit and continuous monitoring requirements (AU/SI control families).
- Vulnerability Management & Response
- Lead code reviews, SAST/DAST scans, and targeted penetration testing; document findings against control frameworks.
- Triage and remediate vulnerabilities within POA&M timelines; maintain artifact evidence for compliance assessments.
- Support incident response for application-layer events; contribute to after-action reports and corrective action plans.
- Cross-functional Collaboration
- Serve as the embedded security champion for engineering squads, raising the security bar through mentorship and code review culture.
- Develop and deliver security training and runbooks tailored to engineering and DevOps team members.
- Collaborate with DevOps/SRE to enforce secure IaC, WAF rules, network controls, and runtime monitoring across AWS and Azure environments.
Required Qualifications
- Bachelor’s degree in Computer Science, Engineering, or related field—or equivalent experience.
- 3+ years of software engineering experience with a strong focus on security.
- Proficiency in one or more programming languages (e.g., JavaScript/TypeScript, Python, Go, C#).
- Experience with secure coding practices and frameworks.
- Strong understanding of application security principles, including:
- OWASP Top 10
- Secure API/REST design
- Cryptography fundamentals
- Authentication/authorization patterns
- Experience with code scanning tools (SAST/DAST), threat modeling, and penetration testing.
- Familiarity with NIST 800-171, CMMC, or FedRAMP security control requirements and evidence collection.
- Hands-on experience with AWS and/or Azure security services (IAM, WAF, Security Hub, Defender, Sentinel); GCC High or GovCloud experience a plus.
Preferred Qualifications
- Experience with container security (Docker, ECS).
- Working knowledge of Zero Trust Architecture principles.
- Experience building DevSecOps pipelines in regulated environments; familiarity with tools like Prisma, Checkov, Snyk, or Aqua.
- Relevant certifications (any of the following):
- CISSP, CSSLP, or CASP+
- OSCP
- CEH
- GIAC (GWAPT, GSEC, GWEB) or CCP/CCA (UK Cyber Essentials equivalent)
- Experience securing microservices or event-driven architectures on ECS; background in federal or cleared environments preferred.
Job Description
We are seeking a Security Software Engineer to build and harden software systems supporting DoD programs operating under CMMC/NIST 800-171/FedRAMP compliance requirements. You will embed security across the SDLC—from design and code review through CI/CD and cloud deployment—working alongside engineering, DevSecOps, and IT teams in a regulated, cloud-native environment (AWS Commercial and GovCloud, Azure GCC High).
Responsibilities
- Core Engineering & Secure Development
- Design and develop secure software with a security-first mindset baked into every phase of the SDLC.
- Apply secure coding standards, threat modeling, and vulnerability mitigation aligned to NIST 800-53 and CMMC Level 2/3 controls.
- Conduct architecture reviews and code hardening to address OWASP Top 10 and DoD STIGs.
- Automate security gates in CI/CD pipelines (SAST, DAST, dependency scanning, secrets detection).
- Security Architecture & Controls
- Design secure system and API architectures for multi-tenant cloud environments, including GCC High and FedRAMP-authorized platforms.
- Implement IAM controls, JIT provisioning, SSO/SAML/OIDC flows, and least-privilege authorization frameworks (e.g., Cognito, Azure AD).
- Instrument applications with security logging and monitoring that satisfies audit and continuous monitoring requirements (AU/SI control families).
- Vulnerability Management & Response
- Lead code reviews, SAST/DAST scans, and targeted penetration testing; document findings against control frameworks.
- Triage and remediate vulnerabilities within POA&M timelines; maintain artifact evidence for compliance assessments.
- Support incident response for application-layer events; contribute to after-action reports and corrective action plans.
- Cross-functional Collaboration
- Serve as the embedded security champion for engineering squads, raising the security bar through mentorship and code review culture.
- Develop and deliver security training and runbooks tailored to engineering and DevOps team members.
- Collaborate with DevOps/SRE to enforce secure IaC, WAF rules, network controls, and runtime monitoring across AWS and Azure environments.
Required Qualifications
- Bachelor’s degree in Computer Science, Engineering, or related field—or equivalent experience.
- 3+ years of software engineering experience with a strong focus on security.
- Proficiency in one or more programming languages (e.g., JavaScript/TypeScript, Python, Go, C#).
- Experience with secure coding practices and frameworks.
- Strong understanding of application security principles, including:
- OWASP Top 10
- Secure API/REST design
- Cryptography fundamentals
- Authentication/authorization patterns
- Experience with code scanning tools (SAST/DAST), threat modeling, and penetration testing.
- Familiarity with NIST 800-171, CMMC, or FedRAMP security control requirements and evidence collection.
- Hands-on experience with AWS and/or Azure security services (IAM, WAF, Security Hub, Defender, Sentinel); GCC High or GovCloud experience a plus.
Preferred Qualifications
- Experience with container security (Docker, ECS).
- Working knowledge of Zero Trust Architecture principles.
- Experience building DevSecOps pipelines in regulated environments; familiarity with tools like Prisma, Checkov, Snyk, or Aqua.
- Relevant certifications (any of the following):
- CISSP, CSSLP, or CASP+
- OSCP
- CEH
- GIAC (GWAPT, GSEC, GWEB) or CCP/CCA (UK Cyber Essentials equivalent)
- Experience securing microservices or event-driven architectures on ECS; background in federal or cleared environments preferred.
See all 101+ STEM OPT Security Software Engineer Jobs
Sign up for free to unlock all listings, filter by visa type, and get alerts for new STEM OPT Security Software Engineer Jobs.
Get Access To All JobsTips for Finding STEM OPT Authorization as a Security Software Engineer
Verify your CIP code before applying
Check that your degree's CIP code appears on the DHS STEM Designated Degree Program List. Cybersecurity and computer science programs typically qualify, but information systems degrees sometimes don't, so confirm with your DSO before accepting an offer.
Filter employers by E-Verify enrollment status
Before sending applications, confirm each employer is enrolled in E-Verify using the E-Verify employer search. Security software roles often appear at defense contractors and regulated financial firms, which are enrolled by compliance requirements, making them reliable targets.
Align your I-983 training plan to the role
Work with your hiring manager to map the Security Software Engineer job duties to specific learning objectives in the I-983. USCIS requires a demonstrable connection between your degree field and the role's technical scope, so vague job descriptions create extension risk.
Target employers with cleared or regulated environments
Use Migrate Mate to find Security Software Engineer openings filtered for STEM OPT-eligible employers. Defense, fintech, and healthcare IT employers often have structured onboarding for work-authorization candidates and existing E-Verify infrastructure already in place.
Address security clearance timing during offer negotiation
Many Security Software Engineer roles list clearance eligibility as preferred rather than required at hire. Clarify during the offer stage whether the role requires an active clearance on day one, since sponsoring your STEM OPT extension and initiating a clearance process run in parallel.
Submit your STEM OPT extension application 90 days early
File your STEM OPT extension application with USCIS up to 90 days before your initial OPT expires. If your I-765 is pending on your OPT end date, your cap-gap protection keeps your work authorization continuous while USCIS adjudicates the extension.
Frequently Asked Questions
Does a cybersecurity degree qualify for the STEM OPT extension for Security Software Engineer roles?
Cybersecurity degrees typically qualify if the program's CIP code appears on the DHS STEM Designated Degree Program List. Common qualifying codes include 11.1003 (Computer and Information Systems Security) and related computer engineering fields. Confirm your specific CIP code with your DSO before filing, since the degree program determines eligibility, not the job title itself.
What E-Verify requirement applies to employers hiring Security Software Engineer STEM OPT students?
Any employer hiring you on a STEM OPT extension must be enrolled in E-Verify at the worksite level where you'll work, not just at the company's headquarters. You can verify enrollment through the E-Verify employer search before accepting an offer. Without active E-Verify enrollment, the employer cannot legally employ you on the 24-month extension.
How should the I-983 training plan reflect Security Software Engineer job duties?
The I-983 must connect your specific engineering or computer science degree to the role's technical responsibilities. For Security Software Engineer positions, this means documenting learning objectives around secure code development, vulnerability assessment, or systems architecture that directly relate to your degree field. USCIS reviews this connection during adjudication, so generic job descriptions weaken the filing.
How does cap-gap protection work if my initial OPT expires while my STEM OPT extension is pending?
If you file your STEM OPT extension application before your initial OPT EAD expires, cap-gap protection automatically extends your work authorization while USCIS processes the I-765. You can continue working as a Security Software Engineer during this period without interruption. Carry both your expired EAD and your I-20 with the STEM OPT extension recommendation as proof of authorized status.
Where can I find Security Software Engineer jobs from employers already set up to hire STEM OPT students?
Migrate Mate lists Security Software Engineer roles filtered for employers with E-Verify enrollment and a history of hiring F-1 students on OPT. Searching there saves you from applying to companies that will stall or withdraw offers once they learn the E-Verify and I-983 requirements apply. You can also cross-reference the O*NET occupation profile to identify which degree fields align with the role's defined skill set.