Cybersecurity Assessment Engineer
Second Front Systems4 months ago
Remote, United StatesSenior
Base Salary
$155k - $175k/yr
Responsibilities
- Perform technical security assessments of customer applications and services before and after deployment through Game Warden.
- Review application artifacts, container images, software dependencies, infrastructure configurations, data flows, APIs, and deployment documentation for security weaknesses.
- Analyze SAST, DAST, software composition analysis, container scanning, infrastructure-as-code scanning, secrets detection, and vulnerability management results.
- Provide risk analysis, remediation guidance, vulnerability exception recommendations, and documented assessment records to technical and nontechnical stakeholders.
- Support RMF, FedRAMP, and continuous monitoring activities by partnering with security authorization and engineering teams.
Requirements
- 5 to 7 years of hands-on experience in application security, product security, vulnerability assessment, cloud security, penetration testing, DevSecOps, or a closely related technical security discipline.
- Strong knowledge of application and cloud vulnerabilities, including OWASP Top 10, insecure configurations, dependency risk, secrets exposure, authentication, authorization, and software supply chain threats.
- Hands-on experience assessing applications or services deployed in AWS, Azure, or Google Cloud; direct AWS experience is strongly preferred.
- Working knowledge of containers, Docker, Kubernetes, container registries, CI/CD pipelines, and modern software delivery practices.
- Experience with security testing technologies including SAST, DAST, software composition analysis, container scanning, infrastructure-as-code scanning, secrets detection, and vulnerability scanners.
- Ability to interpret CVEs, CVSS vectors, EPSS scores, CISA KEV entries, vendor advisories, exploit information, SBOMs, and third-party dependency risks.
- Working knowledge of DISA STIGs, Security Requirements Guides, CIS Benchmarks, NIST SP 800-53, NIST SP 800-37, continuous monitoring, and government authorization evidence.
- U.S. citizenship and the ability to obtain and maintain a Public Trust determination are required.
- Preferred qualifications include experience with FedRAMP Moderate or High, DoD RMF, Kubernetes-based DevSecOps platforms, platform-as-a-service environments, multi-tenant cloud services, and software development teams.
- Preferred familiarity includes GitLab, Docker, Kubernetes, Terraform, Anchore, Trivy, Tenable, cloud-native observability tooling, and certifications such as Security+, CySA+, CSSLP, AWS Certified Security, Certified Kubernetes Security Specialist, or GIAC.
Benefits
- Full-time position with flexible remote work opportunities for candidates residing in approved hiring hubs in the DC/Maryland/Virginia, Raleigh/Durham/Chapel Hill, Denver/Colorado Springs, or Dallas/Fort Worth areas.
- 100% employer-paid medical, dental, and vision coverage for employees and dependents.
- 401(k) with a 3% company contribution.
- Wellness benefits including One Medical membership, mental health resources, and family planning support.
- Equity incentive plan, new-hire technology and home office stipend, annual professional development stipend, and employee referral bonus program.
- Flexible paid time off, federal holidays, and generous parental leave.
About Second Front Systems
Second Front Systems builds a SaaS/PaaS platform that streamlines software accreditation, hosting, and continuous delivery on government and classified networks, helping vendors achieve ATO and FedRAMP/DoD IL compliance. It sells to U.S. defense and civilian agencies and to commercial ISVs entering regulated markets, supporting environments used by the DoD, UK Ministry of Defence, and NATO. The company is privately held and headquartered in Wilmington, Delaware.