Cybersecurity Assessment Engineer

Second Front Systems, Inc.; United States; Remote; USD 155,000 - 175,000; Full time

Benefits offered by this job

Health coverage

401(k) plan

Wellness benefits

Equity incentive

Home office stipend

Flexible PTO

Parental leave

Remote work opportunities

Referral bonus

Job summary

Second Front Systems, Inc. is seeking a Cybersecurity Assessment Engineer to perform hands-on security assessments of software deployed through the Game Warden platform.

You will investigate findings, understand how applications are built and deployed, and provide practical guidance to engineering teams. Reporting to the Head of Product Security & Compliance, you will assess customer apps, cloud configurations, dependencies, and supporting artifacts before and after deployment, influencing risk,

Qualifications

• Hands-on experience in application security and vulnerability assessment.
• Familiarity with OWASP Top 10 and secure configurations.
• Experience in cloud platforms (AWS/Azure/GCP) and DevSecOps.
• Ability to interpret CVEs, CVSS, and risk implications.
• Ability to explain findings to engineers and customers.

Responsibilities

• Perform technical security assessments of customer apps and services via Game Warden.
• Review artifacts, container images, dependencies, configurations, and deployment docs for weaknesses.
• Analyze results from SAST, DAST, SCA, container scanning, and CI/CD tooling.
• Serve as a security partner to engineering and customer teams.
• Provide remediation guidance with clear risk and actions.
• Support RMF, FedRAMP, and continuous monitoring evidence.

Skills

5-7 years experience

Cloud security

SAST/DAST/SCA

AWS/Azure/GCP

Containers & Docker

Kubernetes

Security testing tools

Tools

GitLab

Anchore

Trivy

Tenable

Terraform

CI/CD pipelines

Job description

Second Front Systems (2F) is seeking a Cybersecurity Assessment Engineer to perform hands‑on security assessments of software deployed through the Game Warden platform.

This is not a scan‑operator or checklist‑only position. We are looking for someone who can investigate technical findings, understand how an application is built and deployed, distinguish meaningful risk from scanner noise, and give engineering teams practical guidance they can act on.

Reporting to the Head of Product Security & Compliance, you will assess customer applications, container images, cloud configurations, software dependencies, and supporting artifacts before and after deployment. You will work directly with Product, Platform Engineering, DevOps, Mission Success, and customer development teams to identify vulnerabilities, evaluate their actual risk, and determine whether an application is ready to operate within Game Warden.

Your work will directly influence deployment decisions, vulnerability remediation, continuous monitoring, and the security posture of a platform supporting mission‑critical government software.

Note:

Candidates must reside in one of our approved hiring hubs:

What You'll Do

• Perform technical security assessments of customer applications and services seeking deployment through the Game Warden platform.
• Review application artifacts, container images, software dependencies, infrastructure configurations, data flows, APIs, and deployment documentation to identify security weaknesses.
• Analyze results from SAST, DAST, software composition analysis, container scanning, infrastructure‑as‑code scanning, secrets detection, and vulnerability management tools.
• Serve as a trusted technical security partner to Mission Success, Platform Engineering, DevOps, and customer development teams.
• Partner with Security Authorization Specialists to ensure technical assessment results and supporting evidence can be used for RMF, FedRAMP, and continuous monitoring activities.
• Provide developers with clear remediation guidance that identifies the vulnerable component, explains the risk, and recommends specific corrective actions.
• Evaluate requests for vulnerability exceptions or delayed remediation. Validate the stated rationale, examine compensating controls, and provide a documented risk recommendation to the appropriate approving authority.
• Support recurring continuous monitoring reviews by identifying new vulnerabilities, configuration drift, outdated dependencies, and changes affecting previously assessed applications.
• Communicate assessment results directly to technical and nontechnical stakeholders, including customers who may need help understanding findings and remediation expectations.
• Produce clear assessment records that document the scope, methodology, evidence reviewed, findings identified, risk analysis performed, and remediation status.

What You Bring

• Posses 5 to 7 years of hands‑on experience in application security, product security, vulnerability assessment, cloud security, penetration testing, DevSecOps, or a closely related technical security discipline.
• Strong understanding of common application and cloud vulnerabilities, including the OWASP Top 10, insecure configurations, dependency risk, secrets exposure, authentication weaknesses, authorization failures, and software supply chain threats.
• Hands‑on experience assessing applications or services deployed in AWS, Azure, or Google Cloud. Direct AWS experience is strongly preferred.
• Working knowledge of containers, Docker, Kubernetes, container registries, CI/CD pipelines, and modern software delivery practices.
• Experience using multiple security testing technologies, such as SAST, DAST, software composition analysis, container scanning, infrastructure‑as‑code scanning, secrets detection, and vulnerability scanners.
• The ability to interpret CVEs, CVSS vectors, EPSS scores, CISA KEV entries, vendor advisories, exploit information, and other sources used to assess vulnerability risk.
• Experience reviewing SBOMs and investigating vulnerable open‑source or third‑party software dependencies.
• Working knowledge of DISA STIGs, Security Requirements Guides, CIS Benchmarks, and secure configuration practices.
• Practical understanding of NIST SP 800‑53, NIST SP 800‑37, continuous monitoring, and the role technical assessment evidence plays in government authorization programs.
• The ability to explain a technical finding clearly, defend a risk conclusion, and provide useful remediation guidance to software engineers and customers.
• Sound judgment when working through incomplete information, conflicting scan results, and security issues without an obvious resolution.
• Demonstrated experience interpreting security scan results and independently validating whether reported vulnerabilities are accurate, reachable, and exploitable.

Preferred

• Active U.S. Secret security clearance.
• Experience supporting FedRAMP Moderate, FedRAMP High, DoD RMF, or other government authorization programs.
• Experience securing or assessing Kubernetes‑based DevSecOps platforms, platform‑as‑a‑service environments, or multi‑tenant cloud services.
• Familiarity with GitLab, Docker, Kubernetes, Terraform, Anchore, Trivy, Tenable, and cloud‑native observability tooling.
• Experience working directly with software development teams to remediate vulnerabilities and improve secure development practices.
• Certifications such as Security+, CySA+, CSSLP, AWS Certified Security, Certified Kubernetes Security Specialist, GIAC, or comparable technical credentials.
• A strong interest in protecting national security systems and improving how mission software is evaluated and delivered.

Success at 2F Looks Like:

• A proactive and solutions oriented mindset
• Viewing obstacles as opportunities for growth
• Having a bias toward action and tangible, measurable results
• Being team‑oriented with a focus on personal responsibility and autonomy

The base salary for this position will fall between $155,000 and $175,000. Your ultimate compensation will be determined by professional background, technical proficiency, seniority, and regional cost factors. Furthermore, this opportunity includes potential eligibility for equity awards and discretionary bonuses, rounding out a comprehensive total rewards offering.

This role is a full time position. As a public benefit corporation, we’re a team of purpose‑driven trailblazers transforming the future of U.S. national security. We hire the best to do their best and, as such, we are committed to providing the perks and benefits you need to be successful—both in‑ and outside the workplace.

Perks of Joining Our Team:

• 100% employer‑paid medical, dental, and vision coverage for you and your dependents
• 401(k) with a 3% company contribution
• Comprehensive wellness benefits, including a One Medical membership, mental health resources, family planning support, and more
• Equity incentive plan
• New hire technology and home office stipend
• Flexible paid time off, plus all federal holidays
• Generous parental leave
• Flexible remote work opportunities
• Employee referral bonus program

Who We Are:

Second Front Systems (2F) is a public‑benefit software company powering software for the free world. We eliminate the friction that slows innovation, enabling faster, more secure development and deployment of software across government and regulated networks. Built by national security veterans and backed by top‑tier venture capital, our platform is trusted by the world’s leading organizations to cut deployment timelines from years to weeks. We move fast, solve hard problems, and deliver trusted capabilities where they’re needed most. Our work strengthens global security and gives the United States and its allies a lasting competitive advantage. Learn more at secondfront.com.

One last thing:

We are an equal opportunity employer and all qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity or expression, pregnancy, age, national origin, disability status, genetic information, protected veteran status, or any other characteristic protected by law.

State notices:

In accordance with Colorado law, applicants may redact their date of birth, dates of attendance, and dates of graduation from any uploaded documents.

Maryland:

Under Maryland law, an employer may not require or demand, as a condition of employment, prospective employment, or continued employment, that an individual submit to or take a polygraph examination or similar test. An employer who violates this law is guilty of a misdemeanor and subject to a fine not exceeding $100.