Cybersecurity Engineer

TrekFed; United States; Hybrid; USD 140,000 - 190,000; Full time

Job summary

TrekFed is seeking a highly skilled AWS GovCloud Security Engineer to secure and maintain cloud infrastructure supporting continuous authorization (cATO) in classified environments. You will perform hands-on cloud security engineering, boundary protection, vulnerability management, STIG/SRG assessments, patching, and POA&Ms tracking in line with NIST 800-53 and FedRAMP.

You will triage findings, review infrastructure-as-code changes for security impacts, coordinate incident response across

Qualifications

• Ability to quickly secure Secret security clearance.
• Experience working in classified environments and handling classified information.
• Applying secure coding practices and documentation standards.
• Collaborating with cross-functional teams and vendors to define, design, and deploy features.
• Demonstrated experience securing AWS cloud infrastructure including IAM, networking, logging, and boundary protection.
• Hands-on experience with infrastructure vulnerability management, patching, STIG/SRG assessments, SCAP results, and POA&Ms tracking.
• Experience with security incident triage and coordination across infrastructure, application, and Government security teams.
• Ability to review infrastructure-as-code and configuration changes for security impacts.
• Demonstrated proficiency with AWS GovCloud environments and native security services.

Responsibilities

• Operate and maintain cloud boundary protection capabilities, including perimeter controls, segmentation, security logging, and monitoring.
• Perform infrastructure vulnerability assessments, configuration reviews, hardening, patching, and remediation validation against STIG/SRG/cATO requirements.
• Maintain infrastructure POA&Ms and track findings through remediation or approved disposition within cATO timelines.
• Produce and maintain infrastructure authorization evidence including boundary diagrams, dataflows, inventories, controls, STIG/SRG/SCAP results, patch records, and continuous monitoring records.
• Review security impacts of landing-zone, identity and access, network, and infrastructure-as-code changes; coordinate security requirements at cross-domain interfaces.
• Implement and document security controls aligned with NIST 800-53 and FedRAMP compliance requirements, supporting continuous authorization across cloud environments.

Job description

This role is responsible for securing and maintaining AWS GovCloud infrastructure in support of continuous authorization (cATO) within classified environments. The position combines hands‑on cloud security engineering including boundary protection, vulnerability management, STIG/SRG assessments, patching, and POA&Ms tracking with NIST 800-53 and FedRAMP compliance evidence production and continuous monitoring. The engineer will triage security findings, review infrastructure-as-code changes for security impacts, coordinate incident response across cross‑contractor teams, and build strong client relationships through clear, consistent communication.

Requirements

DUTIES AND RESPONSIBILITIES:

Client Relationship:

• Build a great relationship with the client
• Understand our clients: drivers, needs, and pains
• Work with internal and external leadership and engineering teams to formulate the best and consistent client communication

Technical Responsibilities:

• Operate and maintain cloud boundary protection capabilities, including perimeter controls, segmentation, security logging, and monitoring
• Perform infrastructure vulnerability assessments, configuration reviews, hardening, patching, and remediation validation against applicable STIG, SRG, and cATO requirements
• Maintain infrastructure POA&Ms and track critical and high findings through remediation or approved disposition within BESPIN Security's cATO timelines
• Produce and maintain infrastructure authorization evidence, including boundary diagrams and dataflows, inventories, implemented and inherited controls, STIG/SRG/SCAP results, patch records, and continuous monitoring records
• Keep evidence current before each boundary change and consolidate infrastructure evidence quarterly ahead of the companion contractor's BOE delivery
• Review security impacts of landing‑zone, identity and access, network, and infrastructure-as-code changes; coordinate security requirements at cross-domain interfaces
• Implement and document security controls aligned with NIST 800-53 and FedRAMP compliance requirements, supporting continuous authorization activities across cloud environments

REQUIRED QUALIFICATIONS:

• Ability to quickly secure Secret security clearance
• Experience working in classified environments and handling classified information in accordance with applicable security requirements
• Applying secure coding practices and documentation standards
• Collaborating with cross‑functional teams and other vendors to define, design, and deploy features
• Demonstrated experience securing AWS cloud infrastructure, including identity and access, networking, segmentation, logging, monitoring, and boundary protection
• Hands‑on experience with infrastructure vulnerability management, patching, STIG/SRG assessments, SCAP results, and POA&Ms tracking
• Experience with security incident triage and coordination across infrastructure, application, and Government security teams
• Ability to review infrastructure-as-code and configuration changes for security impacts
• Demonstrated proficiency with AWS GovCloud environments and AWS‑native security services
• Ability to troubleshoot and debug applications to ensure optimal performance

PREFERRED QUALIFICATIONS:

• Knowledge of DoD policies, regulations, procedures, and processes
• Experience in the technology industry or related field
• Experience with professional services or consulting
• Direct experience with AWS GovCloud, JOSCE/JWCC environments, eMASS, and cross-domain interfaces would also be valuable
• Experience with GitLab, including security pipeline configuration and management, multi-repository pipeline jobs, and CVE analysis and allow‑list maintenance
• Experience supporting RMF/cATO processes and preparing infrastructure control and configuration evidence, including familiarity with NIST 800-53 and FedRAMP compliance frameworks
• Ability to distinguish inherited controls from contractor‑implemented controls and maintain evidence as infrastructure changes

PHYSICAL AND MENTAL REQUIREMENTS:

• Continuous mental and/or visual attention required
• Requires the ability to remain stationary for long periods of time
• Regularly communicates to various people
• Large amount of reading and analysis is required
• Requires the ability to focus for an extended period of time
• Requires the ability to travel
• Requires the ability to work both remotely and at clients' offices