second-front-systems - Cybersecurity Assessment Engineer

Remote - Washington, DC, District of Columbia , United States$125k - $140k+ Equity3mo ago

Remote Senior NA Cybersecurity Cloud Computing Cybersecurity Engineer Cross-functional Collaboration Reporting AWS Azure Performance Reviews

Requirements

• Posses 5 to 7 years of hands-on experience in application security, product security, vulnerability assessment, cloud security, penetration testing, DevSecOps, or a closely related technical security discipline. • Strong understanding of common application and cloud vulnerabilities, including the OWASP Top 10, insecure configurations, dependency risk, secrets exposure, authentication weaknesses, authorization failures, and software supply chain threats. • Hands-on experience assessing applications or services deployed in AWS, Azure, or Google Cloud. Direct AWS experience is strongly preferred. • Working knowledge of containers, Docker, Kubernetes, container registries, CI/CD pipelines, and modern software delivery practices. • Experience using multiple security testing technologies, such as SAST, DAST, software composition analysis, container scanning, infrastructure-as-code scanning, secrets detection, and vulnerability scanners. • The ability to interpret CVEs, CVSS vectors, EPSS scores, CISA KEV entries, vendor advisories, exploit information, and other sources used to assess vulnerability risk. • Experience reviewing SBOMs and investigating vulnerable open-source or third-party software dependencies. • Working knowledge of DISA STIGs, Security Requirements Guides, CIS Benchmarks, and secure configuration practices. • Practical understanding of NIST SP 800-53, NIST SP 800-37, continuous monitoring, and the role technical assessment evidence plays in government authorization programs. • The ability to explain a technical finding clearly, defend a risk conclusion, and provide useful remediation guidance to software engineers and customers. • Sound judgment when working through incomplete information, conflicting scan results, and security issues without an obvious resolution. • Demonstrated experience interpreting security scan results and independently validating whether reported vulnerabilities are accurate, reachable, and exploitable. • Active U.S. Secret security clearance. • Experience supporting FedRAMP Moderate, FedRAMP High, DoD RMF, or other government authorization programs. • Experience securing or assessing Kubernetes-based DevSecOps platforms, platform-as-a-service environments, or multi-tenant cloud services. • Familiarity with GitLab, Docker, Kubernetes, Terraform, Anchore, Trivy, Tenable, and cloud-native observability tooling. • Experience working directly with software development teams to remediate vulnerabilities and improve secure development practices. • Certifications such as Security+,CySA+, CSSLP, AWS Certified Security, Certified Kubernetes Security Specialist, GIAC, or comparable technical credentials. • A strong interest in protecting national security systems and improving how mission software is evaluated and delivered. • The base salary for this position will fall between $155,000 and $175,000. Your ultimate compensation will be determined by professional background, technical proficiency, seniority, and regional cost factors. Furthermore, this opportunity includes potential eligibility for equity awards and discretionary bonuses, rounding out a comprehensive total rewards offering. • Success at 2F Looks Like: • A proactive and solutions oriented mindset • Viewing obstacles as opportunities for growth • Having a bias toward action and tangible, measurable results • Being team-oriented with a focus on personal responsibility and autonomy

Responsibilities

• Review web application artifacts of customer developed applications and provide customer feedback • Primary face of the cybersecurity team to software development and mission success teams • Assist with incident response plans to respond to application outages or downtime • Technical Security Validation: Conduct comprehensive assessments of cloud infrastructure, applications, and containerized environments to verify compliance with DISA STIGs, SRGs, and CIS Benchmarks. • Authorization Lifecycle Management: Author, review, and maintain high-quality security artifacts, including System Security Plans (SSP), Security Assessment Plans (SAP), and Security Assessment Reports (SAR). • Continuous Monitoring (ConMon): Monitor and report on the ongoing effectiveness of security controls, ensuring the platform maintains a robust and authorized security posture. • Vulnerability & Risk Analysis: Utilize automated scanning suites (e.g., Anchore, Trivy, Tenable) to identify vulnerabilities, distinguish true positives, and provide actionable remediation guidance to dev teams. • Supply Chain Security: Implement and manage technical workflows for SBOMs (Software Bill of Materials) to support modern, continuous authorization standards. • Cross-Functional Collaboration: Partner with DevOps and Software Engineering teams to translate complex NIST 800-53 controls into implementable technical requirements.

Benefits

• $125K – $140K • Offers Equity • Offers Bonus • Upload your resume here to autofill key application fields. • Drop your resume here! • Parsing your resume. Autofilling key fields... • or drag and drop here • Washington, DC / Maryland / Virginia (DMV area) • Raleigh / Durham / Chapel Hill, North Carolina • Denver / Colorado Springs, Colorado • Dallas / Fort Worth, Texas • Another location- please share below. • Please share if you are not in one of the 4 hubs listed above. • Any additional information • Decline to self-identify • Hispanic or Latino - A person of Cuban, Mexican, Puerto Rican, South or Central American, or other Spanish culture or origin regardless of race. • Hispanic or Latino • White (Not Hispanic or Latino) - A person having origins in any of the original peoples of Europe, the Middle East, or North Africa. • White • Black or African American (Not Hispanic or Latino) - A person having origins in any of the Black racial groups of Africa. • Black or African American • Native Hawaiian or Other Pacific Islander (Not Hispanic or Latino) - A person having origins in any of the peoples of Hawaii, Guam, Samoa, or other Pacific Islands. • Native Hawaiian or Other Pacific Islander • Asian (Not Hispanic or Latino) - A person having origins in any of the original peoples of the Far East, Southeast Asia, or the Indian Subcontinent, including, for example, Cambodia, China, India, Japan, Korea, Malaysia, Pakistan, the Philippine Islands, Thailand, and Vietnam. • Asian • American Indian or Alaska Native (Not Hispanic or Latino) - A person having origins in any of the original peoples of North and South America (including Central America), and who maintain tribal affiliation or community attachment. • American Indian or Alaska Native • Two or More Races (Not Hispanic or Latino) - All persons who identify with more than one of the above five races. • Two or More Races • Hispanic or Latino • White (Not Hispanic or Latino) • Black or African American (Not Hispanic or Latino) • Native Hawaiian or Other Pacific Islander (Not Hispanic or Latino) • Asian (Not Hispanic or Latino) • American Indian or Alaska Native (Not Hispanic or Latino) • Two or More Races (Not Hispanic or Latino) • I identify as one or more of the classifications of protected veteran listed above • I am not a protected veteran