Open-Source Software Security SME

Everforth ECS is seeking a Open-Source Software Security SMEto join our team in Arlington, VA (Hybrid).

ECS is seeking an Open-Source Software (OSS) Security Subject Matter Expert to support the Cybersecurity and Infrastructure Security Agency (CISA). This role will strengthen open-source software security through vulnerability analysis, hands-on software development, and collaboration with technical teams and the open-source community. This is a hybrid position.

• Support CISA’s Secure by Design initiatives and engagement with open-source organizations, maintainers, and vendors.
• Use AI-assisted tools to identify and analyze OSS vulnerabilities, validate findings, and recommend remediation.
• Assess existing vulnerabilities and identify opportunities for software hardening and modernization.
• Provide technical guidance on dependency management, Software Bills of Materials (SBOMs), and software supply chain risks.
• Translate CISA guidance into working tools and software contributions suitable for acceptance into active open-source projects.
• Contribute code, testing, and documentation to an open-source coding agent used as a reference implementation.
• Collaborate with vulnerability management, threat hunting, AI, product, and platform engineering teams.
• Participate in technical pilots and open-source community engagements.

Salary Range: $185,000 - $235,000

General Description of Benefits

• US citizenship with ability to obtain and maintain DHS Suitability (EOD).
• Bachelor’s degree in computer science, Cybersecurity, Software Engineering, or related technical field
• Minimum of 8 years’ professional experience in software development, cybersecurity, or related technical roles
• At least 8 years of hands-on experience in open-source software security, application security, or vulnerability research
• Experience in open-source software security, vulnerability analysis, and software development.
• Demonstrated experience developing, testing, and contributing code to production software systems, and open-source projects.
• Knowledge of secure development practices, dependency management, SBOMs, and software supply chain security.
• Experience using AI-assisted development or security tools and validating their results.
• Strong communication skills and ability to work across technical teams.

• 10+ years of professional experience in software security, with at least 7 years in open-source security
• Experience supporting CISA, DHS, or other federal cybersecurity agencies or programs
• Previous work with critical infrastructure protection or national cybersecurity initiatives
• Experience in technical leadership or architect role guiding security strategy
• Familiarity with Secure by Design initiatives.
• Experience with an Open-Source Program Office (OSPO) or open-source coding agents.

ECS Federal LLC is an equal opportunity employer and does not discriminate or allow discrimination on the basis any characteristic protected by law. All qualified applicants will receive consideration for employment without regard to disability, status as a protected veteran or any other status protected by applicable federal, state, or local jurisdiction law.

Everforth ECS is the federal segment of Everforth, a $4B global organization with over 10,000 employees. Our nearly 3,500 professionals deliver advanced technology solutions in data and AI, cybersecurity, and enterprise transformation, serving defense, intelligence, and federal civilian agencies.

Our work powers mission-critical outcomes, strengthens technology partnerships, and creates meaningful opportunities for our people. We are defined by a commitment to excellence in delivery, a culture of innovation, and an environment where talent can thrive and grow.

We value:

• Attracting and developing top talent and high-performing teams
• Fostering a culture that is engaging, accountable, and mission-driven