Information Systems Security Engineer

This is a fully remote position, open to applicants in Colorado, +1 more state.

📋 Description

• Design and implement identity and access management frameworks across AWS, Azure, and GCP.

• Develop and sustain authorization boundaries, network architectures, and data-flow diagrams.

• Convert engineering and architectural choices into RMF artifacts, SSP sections, control narratives, PPSM registrations, and significant change impact assessments.

• Assess designs and new services against NIST 800-53, DISA Cloud Computing SRG, STIGs, and FedRAMP standards.

• Oversee security and authorization implications of architectural modifications, customer integrations, and new service deployments.

• Counsel ISSMs and ISSOs on the importance of and requirements for re-authorization.

• Collaborate with Solutions Architects and customer architects throughout onboarding, design, and modification processes.

• Implement Zero Trust principles, infrastructure-as-code guardrails, and compliance-as-code methodologies.

• Act as a technical subject matter expert during evaluations, readiness reviews, and audits.

• Assist SCAs and Authorizing Officials with architecture and identity design guidance.

⛳️ Requirements

• 5–8 years of practical experience in security engineering, cloud security architecture, or information assurance.

• At least 4 years of experience in designing and securing production workloads in AWS, Azure, or GCP.

• A minimum of 3 years supporting DoD or federal authorizations under RMF.

• Expert knowledge in identity and access management, including SAML, OIDC/OAuth 2.0, MFA, RBAC/ABAC, privileged access management, cloud-native IAM, and DoD PKI/CAC authentication.

• Significant hands-on experience in architecting and securing environments in AWS, Azure, and/or GCP.

• Familiarity with VPC/VNet design, cloud IAM and account structures, KMS/HSM, logging and monitoring, GuardDuty, Security Hub, Defender for Cloud, GovCloud, containers, Kubernetes, and CI/CD.

• Competence in creating architecture, authorization boundaries, and data-flow diagrams using Lucidchart, draw.io, or Visio.

• In-depth knowledge of NIST 800-37, NIST 800-53 Rev. 4/5, and experience with eMASS or similar GRC tools.

• Awareness of DISA PPSM, CAL, DISA Cloud Computing SRG, STIGs, DoD ICAM policy, and DoD Zero Trust Reference Architecture.

• Active U.S. Secret security clearance is mandatory.

• DoD 8570/8140 IASAE Level II baseline certification (CISSP, CASP+, CSSLP) is required or must be obtained within 90 days.

• At least one professional-level cloud certification must be obtained within 6 months: AWS Certified Security – Specialty, AZ-500, or Google Professional Cloud Security Engineer.

• U.S. citizenship is required.

• Must reside in an approved hiring hub: DC/Maryland/Virginia or Denver/Colorado Springs, CO.

🏝️ Benefits

• 100% employer-sponsored medical, dental, and vision coverage for you and your dependents.

• 401(k) plan with a 3% company contribution.

• Comprehensive wellness benefits, including a One Medical membership, mental health resources, family planning support, and more.

• Equity incentive program.

• Stipend for new hire technology and home office setup.

• Annual stipend for professional development.

• Flexible paid time off, in addition to all federal holidays.

• Generous parental leave policy.

• Options for flexible remote work.

• Employee referral bonus program.

• Possible eligibility for discretionary bonuses.