Federal Security Engineer — DevSecOps & Compliance

UNAVAILABLE; McLean (VA); On-site; USD 120,000 - 170,000; Full time

Job summary

Steampunk is seeking a Security Engineer to support a government customer. You will be the technical expert guiding teams to resolve vulnerabilities, maintain security authorizations, and drive remediation across systems.

The role emphasizes DevSecOps collaboration, threat assessment, and adherence to DHS/FISMA/NIST standards, with opportunities to code and build automation tools for compliance. Strong communication and a customer-service mindset are essential.

Qualifications

• Knowledge of security concepts, practices, and procedures for secure system operation.
• Experience evaluating security controls against FISMA, FIPS, and NIST requirements.
• Experience with vulnerability scanning execution, assessment, and analysis.

Responsibilities

• Review the security architecture of new systems, applications, and technologies to identify and mitigate risks.
• Recommend mitigation measures and advise on design trade-offs, balancing risk and cost.
• Monitor DHS ISVM alerts and drive remediation with system teams.
• Update POA&Ms and track weaknesses to scheduled closures.
• Evaluate waivers and risk acceptance memos with practical technical judgment.
• Monitor gates in the System Lifecycle Management process and brief customer on risks before system readiness.
• Participate in DevSecOps activities to integrate security in Agile/DevOps processes.
• Ensure security requirements are included throughout development lifecycles (Waterfall, Agile, DevSecOps).
• Ensure CM processes to avoid introducing new risks.
• Conduct annual DHS IS performance plan assessments and update security docs as needed.
• Perform system self-assessments for the Ongoing Authorization program.
• Provide audit support for systems (FISMA, DHS, OMB, etc.).
• Maintain knowledge of hardware/software inventory within authorization boundaries.
• Use DHS-mandated IA compliance tools.

Skills

Security concepts

Vulnerability assessment

Application security

Network security

Splunk

Cloud engineering

DevOps

Scripting

Risk management

Communication skills

Education

No degree, 8 years experience

Bachelor's degree + 4 years experience

Master's degree + 1 year experience

Tools

Splunk

Job description

Steampunk is seeking a Security Engineer to support a government customer. You will be the technical expert guiding teams to resolve vulnerabilities, maintain security authorizations, and drive remediation across systems.

The role emphasizes DevSecOps collaboration, threat assessment, and adherence to DHS/FISMA/NIST standards, with opportunities to code and build automation tools for compliance. Strong communication and a customer-service mindset are essential.