phia, LLC

Salesforce Developer

• Provide deep-dive technical support and integration leadership for one of our core product pillars (ARM, CodeScan, or Guard) within a dedicated team structure.
• Architect, implement, and optimize CI/CD pipelines to automate Salesforce deployments using ARM (Automated Release Management).
• Implement and optimize AutoRABIT CodeScan to automate static code analysis (SAST), helping developers identify and fix vulnerabilities before they reach production.
• Implement and optimize AutoRABIT Guard to monitor Salesforce configurations, enforce security policies (HIPAA, GDPR, SOC 2, NIST, FISMA), and automate remediation of misconfigurations.
• Manage integrations between AutoRABIT products and the broader tech stack, including Git repositories, Jira, and Salesforce DX.
• Act as a bridge between technical requirements and mission goals, ensuring the tools work at peak efficiency to reduce downtime and technical debt.

Salesforce Technical Architect – DevSecOps, AutoRABIT

Full-stack Engineer

• Own day-to-day operations of the Burp Suite Enterprise DAST program: scan scheduling, agent and Linux infrastructure health, scan tuning, and result triage across multiple federal application environments.
• Configure and troubleshoot authenticated scans against modern web applications and APIs, including recorded login sequences (via the official Burp recorder Chrome extension), session-handling rules, and macro-based re-authentication.
• Diagnose and resolve Burp Enterprise scan failures end to end: consecutive audit-item failures, skipped insertion points, timeouts, session invalidation, and authentication state loss.
• Extend Burp Suite Professional with custom extensions (Python/Java/Montoya API) to automate repetitive manual verification, custom authentication flows, and findings validation for the bug bounty program.
• Design and implement authenticated scan workflows that survive multi-factor authentication, including SMS one-time passwords, TOTP tokens, hardware dongles, PIV and smart card client-certificate authentication, and SSO federation.
• Administer the AppSec team’s own Linux infrastructure in AWS (currently EC2 with containerized Burp Enterprise components) and contribute to the migration to on-premise OpenShift.
• Convert legacy Python and shell tooling left behind by previous engineers into Ansible roles and playbooks; manage YAML, Dockerfiles, and Kubernetes manifests as code.
• Integrate AppSec tooling into GitHub Actions workflows alongside Dependabot SCA, including the appropriate use of workflow_dispatch versus workflow_call patterns and reusable workflows.
• Provide secondary support to the broader AppSec toolset: Veracode SAST, Contrast IAST for interactive scanning and runtime security testing, GitHub Advanced Security workflows, and the HackerOne bug bounty program (validating reported findings with Burp Suite Professional).

Senior AppSec Engineer – Burp Suite, Linux, Custom Extensions

Application Engineer

• Plan, schedule, and administer SAST and DAST scans using Veracode across a portfolio of federal web applications
• Conduct hands-on application security assessments using Burp Suite Enterprise – including proxy capture, authentication testing, repeater analysis, and manual verification of findings
• Triage scan results to distinguish true positives from false positives
• Integrate and maintain security tooling within CI/CD pipelines using GitHub Actions
• Support complex authentication testing scenarios including PIV card, EntraID, and SSO configurations
• Operate Contrast for IAST coverage across 150+ applications
• Communicate findings, status, and remediation guidance to development teams and federal clients during daily stand-ups and technical sessions
• Maintain working knowledge of evolving threats and federal compliance requirements

Application Security Engineer – Federal DevSecOps

Customer Success Manager

• Provide deep-dive technical support and integration leadership for one of our core product pillars (ARM, CodeScan, or GUARD) within a dedicated team structure.
• Configure and optimize CI/CD pipelines to automate Salesforce deployments using ARM (Automated Release Management).
• Implement and manage CodeScan to automate static code analysis (SAST), helping developers identify and fix vulnerabilities before they reach production.
• Utilize GUARD to monitor Salesforce configurations, enforce security policies (HIPAA, GDPR, SOC 2, NIST, FISMA), and automate remediation of misconfigurations.
• Manage integrations between AutoRABIT products and the broader tech stack, including Git repositories, Jira, and Salesforce DX.
• Act as a bridge between technical requirements and mission goals, ensuring the tools work at peak efficiency to reduce downtime and technical debt.

Salesforce Technical Architect – DevSecOps, AutoRABIT

Senior AppSec Engineer – Burp Suite, Linux, Custom Extensions

Application Security Engineer – Federal DevSecOps

Contingent Salesforce Customer Success/DevSec Engineer