Cybersecurity Engineer (Expert)

Cybersecurity Jobs; McLean (VA); Presencial; USD 148.000 - 168.000; Jornada completa

Descripción de la vacante

Pueo Business Solutions LLC in McLean, VA is seeking a senior cybersecurity engineer to design and secure air-gapped Kubernetes and OpenShift platforms operating within classified enclaves. The role integrates CI/CD security automation, RMF/ATO evidence, Zero Trust controls, and incident response to reduce authorization timelines.

Design and secure multi-tenant clusters, manage registry governance, implement OPA Gatekeeper and Kyverno, and support automated compliance checks in air-gapped

Formación

• Active Top Secret clearance or equivalent eligibility.
• CI poly eligibility
• 16+ years of related experience can substitute for a degree per DoD guidelines.

Responsabilidades

• Design and assist implementation of multi-tenant Kubernetes/OpenShift clusters in disconnected enclaves.
• Manage registry governance including image signing, SBOM/provenance, vulnerability gating, and offline patching.
• Implement admission control using OPA Gatekeeper and Kyverno with RBAC for multi-tenancy in classified environments.
• Assist with securing CI/CD pipelines with SAST, DAST, IaC scanning and automated compliance checks.
• Generate RMF/ATO evidence via OSCAL mappings and eMASS integration.
• Enforce promotion gates with signed, provenance-verified artifacts and successful STIG checks.
• Tailor NIST 800-53 controls for containerized systems and document shared responsibility matrices.
• Enforce Kubernetes/Docker/OpenShift DISA STIGs and manage related exceptions.
• Operate CONMON dashboards with on-prem Prometheus, Falco, and auditd for continuous monitoring.
• Reduce ATO lead times through automation and evidence generation.

Conocimientos

Kubernetes

OpenShift

RKE2

CI/CD security

Zero Trust

PKI management

RMF/ATO mappings

Disaster recovery

Educación

Bachelor’s degree in a related field

Herramientas

OPA Gatekeeper

Kyverno

SAST

DAST

IaC scanning

eMASS

OSCAL

Prometheus

Falco

auditd

Descripción del empleo

Join Pueo Business Solutions LLC as a senior cybersecurity engineer supporting the design and security of air-gapped Kubernetes and OpenShift platforms operating within classified enclaves. The role integrates CI/CD security automation, federal compliance evidence, Zero Trust controls, and incident response operations to reduce authorization timelines and maintain secure operations in SCIF environments.

Role Overview

Design and secure container platforms for mixed-sensitivity workloads in disconnected environments, including multi-tenant cluster architecture, secure artifact governance, and compliance-aligned security control implementation. Support platform assessment and operation while maintaining required data integrity and operational readiness in classified settings.

Key Responsibilities

• Design and assist implementation of multi-tenant Kubernetes/OpenShift clusters in disconnected enclaves.
• Manage registry governance, including image signing, SBOM/provenance, vulnerability gating, and offline patching processes.
• Implement admission control using OPA Gatekeeper and Kyverno, plus RBAC to support multi-tenancy in classified environments.
• Assist with the design and securing of CI/CD pipelines, integrating SAST, DAST, IaC scanning, and automated compliance checks.
• Generate RMF/ATO evidence through OSCAL mappings and eMASS integration.
• Enforce promotion gates that require signed/provenanced artifacts and successful STIG checks.
• Tailor NIST 800-53 controls for containerized systems using shared responsibility matrices.
• Apply and track Kubernetes/Docker/OpenShift DISA STIGs and manage related exceptions.
• Implement continuous monitoring using CONMON dashboards with on-prem tooling such as Prometheus, Falco, and auditd.
• Reduce ATO lead times using automation and evidence generation.
• Implement Zero Trust in Kubernetes with mTLS, service mesh (SPIFFE/SPIRE), and identity propagation across build and runtime layers.
• Operate offline PKI with short-lived certificates and air-gapped roots.
• Design east-west segmentation and support cross-domain artifact transfer with tamper-evident controls.
• Lead or contribute to security initiatives requiring cross-functional coordination.
• Manage competing priorities and complex stakeholder relationships.
• Architect secure, scalable containerized platforms for mixed-sensitivity workloads in SCIFs.
• Map CI/CD artifacts to RMF/ATO controls and accelerate authorization timelines through automation.
• Tailor and reconcile federal compliance requirements across NIST, CNSS, and program-specific directives.
• Implement and enforce Zero Trust end-to-end, from build through runtime.
• Operate and troubleshoot Kubernetes clusters in air-gapped enclaves with minimal external support.
• Detect, investigate, and respond to security incidents while maintaining data integrity in classified environments.
• Coordinate between development, security, and operations teams to implement secure, compliant practices.
• Design and execute disaster recovery and resilience strategies across isolated sites.

Required Qualifications

• Active/current Top Secret security clearance with SCI eligibility.
• Ability to obtain and maintain a CI poly.
• Bachelor’s degree in a related field and 12 years of experience, or additional 4 years of experience in lieu of a completed degree for a total of 16+ years.
• Possess one of the following IAT III certifications in compliance with DoD 8570.01-M and DoD Directive 8140 (e.g., CASP+ CE, CCNP Security, CISA, CISSP (or Associate), GCED, GCIH, CCSP).
• Extensive experience working with Kubernetes, OpenShift, RKE2, and container registry management in air-gapped and classified environments.
• Deep understanding of CI/CD pipeline architectures in disconnected networks.
• Expertise in federal cybersecurity frameworks including NIST 800-53, DISA STIGs, RMF, and ATO processes.
• Familiarity with security testing tools including SAST, DAST, IAST, and IaC, plus automated compliance validation.
• Proven ability enforcing Zero Trust principles, PKI management, and network segmentation in classified environments.
• Strong ability mapping pipeline artifacts to RMF/ATO controls and supporting security operations during incidents.
• Extensive experience in cybersecurity design and architecture.

Technologies

• Kubernetes, OpenShift, RKE2
• Container registry management
• OPA Gatekeeper, Kyverno
• CI/CD pipelines
• SAST, DAST, IaC
• OSCAL, eMASS
• NIST 800-53, DISA STIGs, RMF, ATO
• CONMON, Prometheus, Falco, auditd
• mTLS, SPIFFE, SPIRE, PKI, SPIFFE/SPIRE service mesh
• Docker, CNSS

Desired Qualifications

• Active Top Secret security clearance with SCI eligibility and current CI poly.
• Relevant certifications such as CKA, CKS, GSEC, RHCSA/RHCE, or CASE.
• Some experience leading security projects and initiatives.
• Team collaboration experience, including work in mixed technical teams.

Location and Clearance

• Location: McLean, VA (onsite)

Compensation

• Salary range: USD 147,742 - 167,888 per year