Senior Engineer, Product Security

Job description

Job responsibilities

• Own RMF and the ATO lifecycle end-to-end for your program, from control selection and tailoring through driving implementation with engineering and managing POA&Ms.
• Own the security architecture, don't just document it. Set the security direction for your program: define the controls, propose the solutions, and write the requirements that engineering builds to.
• Define, write, and trace security requirements through systems-engineering processes, including requirements and design reviews and verification and validation, so security is built in and demonstrably met.
• Lead threat modeling across autonomy, embedded, and command-and-control systems, and drive risk assessments that weigh mitigations against mission needs.
• Serve as the STIG subject-matter expert: communicate STIG requirements to engineering, recommend implementation and mitigation approaches, and evaluate, tailor, and defend STIG applicability in negotiation with the…
• Engineering owns hands-on-keyboard hardening; you own the expertise, the requirement translation, and the authorization case.
• Own the solutioning and verify the implementation of security monitoring, logging, and detection; of secure update strategy (signed, atomic, recoverable firmware/OS updates);
• Partner in software supply-chain security, SBOMs, and the secure SDLC (SAST/DAST, code review, CI/CD) helping move the program toward a DevSecOps pipeline built for security.

Job requirements

• 5+ years in security engineering or a closely related field, with the depth to be the security decision-maker on a program. Equivalent demonstrated skill will be considered in lieu of exact tenure.
• BS in Computer Science, Computer Engineering, Information Security, Electrical Engineering, or a relate field, or proof of exceptional skill in lieu of a degree.
• Must be a U.S. Person (as defined under ITAR) and eligible to obtain a U.S. security clearance
• Hands-on RMF/ATO experience. Ideally you've owned a full ATO end-to-end. Regardless, you are knowledgeable about every step of the ATO process and ready to act as the sole SME on it, both internally with engineers and…
• Practical command of the standards and frameworks for this work: NIST 800-37, 800-53, and 800-171; DISA STIGs; and familiarity with eMASS artifact requirements, formats, and review cycles.
• Able to evaluate, tailor, and defend STIG applicability both with the customer and internally, and translate STIG and control requirements into clear implementation or mitigation guidance for engineers.
• Demonstrated depth in both hardware and software security, with a track record of identifying and mitigating high-impact vulnerabilities.
• Ability to write clear security requirements and communicate both the why and the how to software and systems engineers.