GovCloud & FedRAMP Security Software Engineer

Eccalon, LLC; Detroit (MI); On-site; USD 90,000 - 140,000; Full time

Job summary

Eccalon, LLC seeks a Security Software Engineer to build and harden software systems supporting DoD programs, complying with CMMC/NIST 800-171 and FedRAMP requirements. You will embed security across the SDLC in a cloud-native AWS/GovCloud and Azure environment.

Design secure software, apply threat modeling, perform code reviews and vulnerability remediation, and automate security gates in CI/CD. Collaboration with DevSecOps and IT teams is essential in this regulated landscape.

Qualifications

• Bachelor’s degree in Computer Science, Engineering, or a related field (or equivalent experience).
• 3+ years of software engineering with a security focus.
• Experience with secure coding practices and frameworks.
• Familiarity with NIST 800-171, CMMC, or FedRAMP security controls.
• Hands-on AWS/Azure security services (IAM, WAF, Security Hub, Defender).

Responsibilities

• Design and develop secure software with a security-first mindset across the SDLC.
• Apply secure coding standards, threat modeling, and vulnerability mitigation aligned to NIST 800-53 and CMMC.
• Conduct architecture reviews and code hardening against OWASP Top 10 and DoD STIGs.
• Automate security gates in CI/CD pipelines (SAST, DAST, dependency scanning, secrets detection).
• Lead code reviews and vulnerability triage with proper documentation.
• Collaborate with DevOps to enforce secure IaC, WAF rules, and monitoring.

Skills

Software engineering

Secure coding practices

Threat modeling

Code review

AWS/Azure security

Education

Bachelor's degree in Computer Science or Engineering

Tools

SAST/DAST tools

Prisma

Checkov

Snyk

Aqua

Job description

Eccalon, LLC seeks a Security Software Engineer to build and harden software systems supporting DoD programs, complying with CMMC/NIST 800-171 and FedRAMP requirements. You will embed security across the SDLC in a cloud-native AWS/GovCloud and Azure environment.

Design secure software, apply threat modeling, perform code reviews and vulnerability remediation, and automate security gates in CI/CD. Collaboration with DevSecOps and IT teams is essential in this regulated landscape.