Open security roles at Leidos, and what we know about the team behind them.
defense & space · 47000 employees · 9 open roles. Updated October 16, 2026.
Leidos
“Leidos' Application Security philosophy is centered on the principle that 'cyber must be designed into systems from the...”
Leidos
“Leidos' Application Security philosophy is centered on the principle that 'cyber must be designed into systems from the...”
Leidos
“Leidos' Application Security philosophy is centered on the principle that 'cyber must be designed into systems from the...”
Leidos
“Leidos' Application Security philosophy is centered on the principle that 'cyber must be designed into systems from the...”
Leidos
“Leidos' Application Security philosophy is centered on the principle that 'cyber must be designed into systems from the...”
Leidos
“Leidos' Application Security philosophy is centered on the principle that 'cyber must be designed into systems from the...”
Leidos
“Leidos' Application Security philosophy is centered on the principle that 'cyber must be designed into systems from the...”
Leidos
“Leidos' Application Security philosophy is centered on the principle that 'cyber must be designed into systems from the...”
Leidos
“Leidos' Application Security philosophy is centered on the principle that 'cyber must be designed into systems from the...”
Compiled from public job postings, careers pages, and company materials. Data may not reflect current state — verify during interviews.
How they approach application security
The team
The AppSec function is part of the Defensive Cyber group, with Josh Salmanson (VP, Defensive Cyber) serving as a key public-facing leader. The team is integrated into the CIS Group, which provides the 'first line of defense' for proprietary data. Job postings indicate a need for expertise in 'secure software development principles' and 'DevOps concepts.' Exact team size and reporting lines are not publicly available.
What they're working on
Leidos practices 'Shift Left' by requiring candidates to apply 'secure software development principles' during the development phase. Their vulnerability management process includes 'enterprise vulnerability management' and 'penetration testing.' Recent initiatives emphasize 'AI-driven threat detection and response.' There is no public evidence of a formal Security Champions program or specific remediation SLAs.