Information Systems Security Engineer
New
S
Second Front SystemsCybersecurity software
RemoteFull-TimeMiddle
SalaryThe base salary for this position will fall between $200,000-$210,000. This opportunity includes potential eligibility for equity awards and discretionary bonuses.
Apply NowOpens the employer's application page
Job Details
- Experience
- 5–8 years of hands-on security engineering, cloud security architecture, or information assurance; minimum 4 years designing and securing production workloads in AWS, Azure, or GCP; minimum 3 years supporting DoD or federal authorizations under RMF.
- Required Skills
- AWSGCPKubernetesAzure
Requirements
- Have 5–8 years of hands-on security engineering, cloud security architecture, or information assurance experience.
- Have at least 4 years designing and securing production workloads in AWS, Azure, or GCP.
- Have at least 3 years supporting DoD or federal authorizations under RMF.
- Demonstrate expertise in IAM, including SSO and federation (SAML, OIDC/OAuth 2.0), MFA, RBAC/ABAC, privileged access management, cloud-native IAM, and DoD PKI/CAC authentication.
- Have hands-on experience securing cloud environments, including VPC/VNet design, cloud IAM and account structure, encryption and key management, logging and monitoring, native security services, GovCloud, containers, Kubernetes, and CI/CD.
- Produce architecture, authorization boundary, and data-flow diagrams using tools such as Lucidchart, draw.io, or Visio.
- Know NIST 800-37 (RMF), NIST 800-53 (Rev 4/5), and how to translate technical designs into control implementations, SSP content, and RMF workflows in eMASS or similar GRC tools.
- Be familiar with DISA PPSM, CAL, DISA Cloud Computing SRG, STIGs, DoD ICAM policy, and the DoD Zero Trust Reference Architecture.
- Hold an active U.S. Secret security clearance.
- Have or be able to obtain within 90 days a DoD 8570/8140 IASAE Level II baseline certification (CISSP, CASP+, or CSSLP).
- Have or be able to obtain within 6 months at least one professional-level cloud certification, such as AWS Certified Security – Specialty, AZ-500, or Google Professional Cloud Security Engineer.
- Explain complex technical designs to engineering, architecture, compliance, and government stakeholders and produce concise, assessor-ready documentation.
- Be a U.S. citizen.
Responsibilities
- Architect IAM designs covering federation, MFA, RBAC/ABAC, privileged access, and DoD PKI/CAC authentication across AWS, Azure, and GCP.
- Build and maintain authorization boundary, network architecture, and data-flow diagrams covering components, trust boundaries, ports, protocols, and movement of CUI and sensitive data.
- Translate engineering and architecture decisions into RMF artifacts, including SSP architecture sections, control narratives, PPSM registrations, and significant change impact analyses.
- Evaluate designs and services against NIST 800-53, DISA Cloud Computing SRG, STIGs, and FedRAMP requirements, and recommend compliant alternatives.
- Govern the security and authorization impact of architecture changes, customer integrations, and new services; advise ISSMs and ISSOs on significance and re-authorization requirements.
- Coordinate with Solutions Architects and customer architects during onboarding, design, and change activities to incorporate security and authorization requirements.
- Establish Zero Trust principles, infrastructure-as-code guardrails, and compliance-as-code practices in cloud-native environments.
- Serve as the technical subject matter expert during assessments, readiness reviews, and audits, explaining architecture and identity design to SCAs and Authorizing Officials.
View Full Description & ApplyYou'll be redirected to the employer's site
