Information Systems Security Engineer

Second Front Systems; United States; Remote; USD 140,000 - 190,000; Full time

Job summary

Second Front Systems is seeking an Information Systems Security Engineer to strengthen our security-first approach for the Game Warden platform and hosted customer apps. You will own security architecture across identity, access management, and RMF artifacts, collaborating with ISSMs, ISSOs, assessors, and engineers to ensure DoD authorization readiness.

Ideal candidates design secure-by-design solutions, translate architecture into SSPs, and enforce zero-trust principles and compliance-as-code

Qualifications

• 5-8 years hands-on security engineering or cloud security architecture.
• Experience securing production workloads in AWS/Azure/GCP and RMF DoD authorization.

Responsibilities

• Architect identity and access management designs across federation, MFA, RBAC/ABAC, and DoD PKI/CAC.
• Build authorization boundary diagrams, network diagrams, and data-flow diagrams for CUI and sensitive data.
• Translate decisions into RMF artifacts: SSP sections, control narratives, PPSM registrations, change impact analyses.
• Evaluate designs against NIST 800-53, DISA CC SRG, STIGs, and FedRAMP; recommend compliant alternatives.
• Govern security impact of architecture changes and new services; advise ISSMs and ISSOs on re-authorization needs.
• Collaborate with Solutions Architects and customer teams to embed security and authorization from onboarding.
• Establish Zero Trust, IaC guardrails, and compliance-as-code to enforce controls in the cloud.
• Serve as SME during assessments, readiness reviews, and audits.

Skills

Security engineering

Cloud security

RMF DoD

Zero Trust

Job description

Information Systems Security Engineer

Second Front Systems is looking for a technically deep, mission-focused, security-first Information Systems Security Engineer to strengthen our cybersecurity and solutions architecture practice.

Operating at the boundary between engineering delivery and DoD authorization, you will be responsible for owning the security architecture and compliance engineering view of 2F's Game Warden platform and customer applications it hosts.

You will work side by side with Solutions Architects and customers to design secure-by-design solutions and translate engineering decisions into RMF artifacts, control narratives, and authorization evidence, ensuring that solutions are defensible under DoD RMF and hold up to assessor and Authorizing Official review.

We need someone capable of designing and validating identity and access management flows (federation, SAML, OIDC/OAuth 2.0, cloud IAM, DoD PKI/CAC, privileged access) aligned with DoD ICAM and Zero Trust; producing clear authorization boundary diagrams, network architecture diagrams, and data‑flow diagrams that trace CUI and sensitive data end to end; and translating technical architectures into NIST 800-53 control implementations, SSP sections, PPSM registrations, and significant change impact analyses.

As a key partner to ISSMs, ISSOs, assessors, Authorizing Officials, and engineering teams, you will serve as the technical subject matter expert during assessments, readiness reviews, and audits, and advance secure-by-design and compliance-as-code practices across cloud-native environments, serving as the bridge between architecture decisions and authorization boundaries.

Note:

Candidates must reside in one of our approved hiring hubs:

• DC/Maryland/Virginia
• Denver/Colorado Springs, CO

This is a full-time position.

What You'll Do

• Architect identity and access management designs covering federation, MFA, RBAC/ABAC, privileged access, and DoD PKI/CAC authentication across AWS, Azure, and GCP.
• Build and maintain authorization boundary diagrams, network architecture diagrams, and data‑flow diagrams showing components, trust boundaries, ports, protocols, and movement of CUI and sensitive data.
• Translate engineering and architecture decisions into RMF artifacts including SSP architecture sections, AC/IA/SC/AU control narratives, PPSM registrations, and significant change impact analyses.
• Evaluate proposed designs and new services against NIST 800-53, DISA Cloud Computing SRG, STIGs, and FedRAMP requirements and recommend compliant alternatives.
• Govern security and authorization impact of architecture changes, customer integrations, and new services, advising ISSMs and ISSOs on significance and re-authorization requirements.
• Synchronize with Solutions Architects and customer architects during onboarding, design, and change activities to embed security and authorization requirements from first conversation.
• Establish Zero Trust principles, infrastructure-as-code guardrails, and compliance-as-code practices to enforce and evidence security controls automatically in cloud-native environments.
• Own the technical subject matter expert role during assessments, readiness reviews, and audits, walking SCAs and Authorizing Officials through architecture and identity design.

What You Bring

• 5-8 years of hands‑on security engineering, cloud security architecture, or information assurance; minimum 4 years designing and securing production workloads in AWS, Azure, or GCP; minimum 3 years supporting DoD or federal authorizations under RM