1 day ago
Clarksburg, MD, USASenior
Base Salary
$145k - $175k/yr
Responsibilities
- Own the RMF and ATO lifecycle for assigned programs, including control selection, tailoring, implementation tracking, POA&Ms, evidence, documentation, and authorization reviews.
- Act as the security subject-matter expert and primary interface with government cyber or program offices.
- Own security architecture and define security controls, requirements, solutions, mitigations, and secure-by-design direction across hardware and software.
- Write and trace security requirements through systems-engineering requirements reviews, design reviews, verification, and validation.
- Lead threat modeling and risk assessments for autonomy, embedded, and command-and-control systems.
- Evaluate, tailor, communicate, and defend DISA STIG applicability and implementation approaches.
- Own solutioning and implementation verification for security monitoring, logging, detection, secure updates, CVE management, and vulnerability remediation.
- Partner on software supply-chain security, SBOMs, secure SDLC practices, SAST/DAST, code review, CI/CD, and DevSecOps pipeline improvements.
- Audit embedded and application code for vulnerabilities and collaborate with systems, safety, test, DevOps, engineering, and vendors.
Requirements
- 5+ years of experience in security engineering or a closely related field, with demonstrated depth to serve as a program security decision-maker.
- Bachelor's degree in Computer Science, Computer Engineering, Information Security, Electrical Engineering, or a related field, or exceptional demonstrated skill in lieu of a degree.
- Must be a U.S. Person under ITAR and eligible to obtain a U.S. security clearance.
- Hands-on RMF/ATO experience, ideally including ownership of a complete ATO package end-to-end.
- Working knowledge of NIST 800-37, NIST 800-53, NIST 800-171, DISA STIGs, and eMASS artifact requirements and review cycles.
- Demonstrated depth in both hardware and software security, including identifying and mitigating high-impact vulnerabilities.
- Ability to write clear security requirements and explain security rationale and implementation guidance to software and systems engineers.
- Experience with software supply-chain risk management, SBOMs, SAST/DAST, code review, CI/CD, and secure SDLC practices.
- Systems-engineering fluency involving requirements, design reviews, and traceability.
- Working knowledge of FIPS 140-3, cryptographic module validation, TPM/HSM-backed key management, secure boot, and signed firmware.
- Preferred: full ATO ownership, CMMC familiarity, ISO/SAE 21434 and IEC 62443 familiarity, disconnected or industrial systems security experience, CISSP or similar certification, and offensive-security experience.
- Preferred hands-on depth in one or more of C, C++, Python, ARM, x86, and cryptography.
Benefits
- US salary range of $145,000-$175,000 base salary, with equity included in most qualifying full-time roles.
- Hybrid work arrangement in Clarksburg, Maryland: three days per week onsite and two days per week remote.
- Three premium healthcare plan options, including an HSA-eligible plan, with Forterra covering 80% of premiums for employees and dependents.
- Forterra-paid basic life/AD&D and short- and long-term disability insurance, with optional additional life insurance.
- Company holiday calendar with a December winter break and 20 accrued PTO days per year.
- At least seven weeks of fully paid parental leave for birth or adoption.
- $9,000 annual tuition reimbursement or professional development stipend.
- 401(k) plan with traditional, Roth, and after-tax deferral options and company matching up to 4%.
- Stocked beverage refrigerators.
About Forterra
Forterra builds autonomous mission systems for defense and industrial ground operations, including self-driving kits for land vehicles and coordinated robotic swarms. It develops mission-critical hardware and software for autonomy in GPS-denied and contested environments, supporting military logistics, convoying, and yard/drayage use cases. Founded in 2002 and headquartered in Clarksburg, Maryland, the privately held company serves U.S. and allied government programs alongside commercial fleet operators.