Cloud Security Engineer – RMF, STIG & DoD Cloud

Science Applications International Corp.; Chantilly (VA); On-site; USD 160,000 - 200,000; Full time

Job summary

SAIC is a trusted leader delivering advanced command and control capabilities across the Department of the Air Force. This role focuses on accelerating integration, testing, security, and transition of new cloud-enabled capabilities into operations, collaborating with operators, engineers, and government teams to ensure mission readiness.

You will build and secure multi-tenant cloud environments, implement baseline security controls, own RMF/ATO packages, validate security outputs, and

Qualifications

• Bachelor’s with 9+ yrs; Master’s with 7+; PhD/JD with 4+ yrs experience.
• Proven experience securing multi‑classification cloud environments.
• Hands-on STIG review, ACAS/Nessus, SAST/DAST validation.
• Experience maintaining RMF/ATO artifacts (SSP, POA&M, monitoring).
• Familiar with Jira/Xacta workflows for RMF and vulnerability tracking.
• DoD 8140 aligned certs: CISSP, CCSP, CASP+ or equivalent.

Responsibilities

• Build and secure multi‑tenant cloud environments.
• Implement JSIG, NIST SP 800‑53, STIG, and MLS/MILS baselines across Dev/Integration/Test cloud enclaves.
• Own RMF/ATO packages for cloud environments, producing SSP, POA&M, and full RMF evidence.

Skills

Cloud security

RMF/ATO process

Vulnerability management

SAST/DAST

Documentation

Communication

Education

Bachelor’s + experience

Master’s + experience

PhD/JD + experience

Tools

Jira/Xacta

ACAS/Nessus

Terraform

Ansible

Helm

Job description

SAIC is a trusted leader delivering advanced command and control capabilities across the Department of the Air Force. This role focuses on accelerating integration, testing, security, and transition of new cloud-enabled capabilities into operations, collaborating with operators, engineers, and government teams to ensure mission readiness.

You will build and secure multi-tenant cloud environments, implement baseline security controls, own RMF/ATO packages, validate security outputs, and