ICF
Security Engineer - Remote
At a Glance
About This Role
Responsibilities
- Perform Static Application Security Testing (SAST)
- Perform Dynamic Application Security Testing (DAST)
- Work with developers to get them corrected on security issues
- Create and update threat models for FISMA systems
- Work on a path to production for new applications ensuring all documentation and appropriate steps are taken
- Conduct vulnerability scanning
- Implement and maintain NIST 800-53 security controls
- Implement system hardening and DoD STIG requirements
- Identify and help remediate security risks in collaboration with leadership, program teams, architects, and operational stakeholders
Requirements
- Static Application Security Testing (SAST)
- Dynamic Application Security Testing (DAST)
- Vulnerability scanning with Nessus
- Snyk software composition analysis
- AWS GuardDuty and AWS Inspector cloud security
- NIST 800-53 security controls knowledge
- DoD STIG implementation experience
- OWASP Top Ten awareness
- CWE Top 25 awareness
- FISMA system knowledge
- Python/Perl scripting
- AWS, Azure, GCP cloud security
- Threat modeling
- Federal security standards compliance
About ICF
ICF is a global consulting and technology services company based in Fairfax, Virginia. Founded in 1969, it has grown to employ between 1,001 and 5,000 people. ICF specializes in helping clients in both government and commercial sectors tackle complex challenges through a combination of expertise and technology. The company offers a wide range of services, including strategic planning, digital modernization, managed IT and cloud services, cybersecurity, and tailored AI solutions through its ICF Fathom suite. ICF also provides industry-specific solutions, particularly in utility programs, leveraging advanced data modeling. With a diverse team of professionals, ICF emphasizes a culture of ethics and compliance, ensuring data privacy in all its operations. The company collaborates with major technology partners like AWS and Azure to enhance its service offerings.
Security at ICF
Compiled from public job postings, careers pages, and company materials. Data may not reflect current state — verify during interviews.
Security Philosophy
- ICF's AppSec philosophy centers on DevSecOps and compliance automation.
- Their stated mission includes 'DevSecOps' and 'Compliance automation (GroupAssure)' .
- They prioritize 'shifting security left in the development cycle' and providing 'guidance and training to development teams on secure coding practices' .
- Their risk philosophy is guided by Zero Trust concepts, described as an 'organization-wide journey' .
Security Team
The AppSec team is part of the 'Security and resilience' service offering . Key public-facing leaders include Kyle Tuberson (CTO), Michael Boggs (VP, Security and Resilience), and Ralph Framke (Senior Security Architect). Active job postings, such as Senior Software Security Engineer (R2600768), indicate a focus on secure code reviews and vulnerability assessments. The exact reporting line and total team size are not publicly available.
Key Initiatives
Active initiatives include 'shifting security left' and achieving 'Cybersecurity Maturity Model Certification (CMMC) Level 2' in February 2026 . Workflows involve performing 'secure code reviews and static/dynamic analysis' and 'vulnerability scanning' . There is no public evidence of a formal Security Champions program or published remediation SLAs.
Preparing for an AppSec interview?
Get the weekly briefing 2,000+ security pros trust.
Interested in this role?
Apply on LinkedIn