Information Systems Security Engineer

VulnU; Washington, Denver, Colorado Springs (District of Columbia, CO, CO); Remote; USD 200,000 - 210,000; Full time

Benefits offered by this job

Medical coverage

Dental & vision

401(k) plan

Equity incentives

Home office stipend

Professional development stipend

Flexible PTO

Parental leave

Remote work options

Referral bonus

Job summary

Second Front Systems is seeking an Information Systems Security Engineer to own security architecture and RMF artifacts for the Game Warden platform and hosted apps. You will design secure-by-design solutions, translate decisions into RMF artifacts, and ensure compliance across AWS/Azure/GCP environments.

This role requires DoD RMF experience, an active clearance, strong IAM expertise (SAML, OIDC, MFA), and a track record of building secure, compliant cloud architectures.

Qualifications

• 5–8 years of hands-on security engineering, cloud security architecture, or information assurance.
• DoD or federal authorization under RMF experience.
• Active U.S. Secret clearance and at least one cloud certification (AWS/Azure/GCP).

Responsibilities

• Architect IAM designs covering federation, MFA, RBAC/ABAC, and privileged access.
• Produce authorization boundary diagrams, network diagrams, and data-flow maps for CUI data.
• Translate engineering decisions into RMF artifacts ( SSPs, control narratives, PPSM ).
• Evaluate designs against NIST 800-53, DISA SRG, STIGs, and FedRAMP requirements.
• Collaborate with ISSMs/ISSOs, assessors, and auth officials during reviews.
• Enforce Zero Trust and IaC guardrails in cloud-native environments.
• Act as SME during assessments and readiness reviews and guide re‑authorization activities.

Skills

Identity & access management

SAML / OIDC

RMF / DoD compliance

Cloud security architecture

Job description

Information Systems Security EngineerSecond Front Systems is looking for a technically deep, mission-focused, security-first Information Systems Security Engineer to strengthen our cybersecurity and solutions architecture practice.Operating at the boundary between engineering delivery and DoD authorization, you will be responsible for owning the security architecture and compliance engineering view of 2F's Game Warden platform and customer applications it hosts.You will work side by side with Solutions Architects and customers to design secure-by-design solutions and translate engineering decisions into RMF artifacts, control narratives, and authorization evidence, ensuring that solutions are defensible under DoD RMF and hold up to assessor and Authorizing Official review.We need someone capable of designing and validating identity and access management flows (federation, SAML, OIDC/OAuth 2.0, cloud IAM, DoD PKI/CAC, privileged access) aligned with DoD ICAM and Zero Trust; producing clear authorization boundary diagrams, network architecture diagrams, and data-flow diagrams that trace CUI and sensitive data end to end; and translating technical architectures into NIST 800-53 control implementations, SSP sections, PPSM registrations, and significant change impact analyses.As a key partner to ISSMs, ISSOs, assessors, Authorizing Officials, and engineering teams, you will serve as the technical subject matter expert during assessments, readiness reviews, and audits, and advance secure-by-design and compliance-as-code practices across cloud-native environments, serving as the bridge between architecture decisions and authorization boundaries.Note: Candidates must reside in one of our approved hiring hubs:• DC/Maryland/Virginia• Denver/Colorado Springs, COThis is a full-time position. What You'll Do• Architect identity and access management designs covering federation, MFA, RBAC/ABAC, privileged access, and DoD PKI/CAC authentication across AWS, Azure, and GCP.• Build and maintain authorization boundary diagrams, network architecture diagrams, and data-flow diagrams showing components, trust boundaries, ports, protocols, and movement of CUI and sensitive data.• Translate engineering and architecture decisions into RMF artifacts including SSP architecture sections, AC/IA/SC/AU control narratives, PPSM registrations, and significant change impact analyses.• Evaluate proposed designs and new services against NIST 800-53, DISA Cloud Computing SRG, STIGs, and FedRAMP requirements and recommend compliant alternatives.• Govern security and authorization impact of architecture changes, customer integrations, and new services, advising ISSMs and ISSOs on significance and re-authorization requirements.• Synchronize with Solutions Architects and customer architects during onboarding, design, and change activities to embed security and authorization requirements from first conversation.• Establish Zero Trust principles, infrastructure-as-code guardrails, and compliance-as-code practices to enforce and evidence security controls automatically in cloud-native environments.• Own the technical subject matter expert role during assessments, readiness reviews, and audits, walking SCAs and Authorizing Officials through architecture and identity design. What You Bring• 5–8 years of hands-on security engineering, cloud security architecture, or information assurance; minimum 4 years designing and securing production workloads in AWS, Azure, or GCP; minimum 3 years supporting DoD or federal authorizations under RMF.• Expert fluency in identity and access management: SSO and federation (SAML, OIDC/OAuth 2.0), MFA, RBAC/ABAC, privileged access management, cloud-native IAM (AWS IAM, GCP IAM, Azure RBAC), and DoD PKI/CAC authentication.• Extensive hands-on experience architecting and securing AWS, Azure, and/or GCP environments including VPC/VNet design, cloud IAM and account structure, encryption and key management (KMS/HSM), logging and monitoring, native security services (GuardDuty, Security Hub, Defender for Cloud), GovCloud, and cloud-native patterns (containers, Kubernetes, CI/CD).• Demonstrated ability to produce clear, accurate architecture, authorization boundary, and data-flow diagrams suitable for authorization packages and assessor review using tools such as Lucidchart, draw.io, or Visio.• Strong working knowledge of NIST 800-37 (RMF) and NIST 800-53 (Rev 4/5) with ability to translate technical designs into control implementations, SSP content, and RMF workflows in eMASS or similar GRC tools.• Familiarity with DISA PPSM, CAL, DISA Cloud Computing SRG, STIGs, DoD ICAM policy, and DoD Zero Trust Reference Architecture.• Active U.S. Secret security clearance required; DoD 8570/8140 IASAE Level II baseline certification (CISSP, CASP+, CSSLP) required or obtainable within 90 days; at least one professional-level cloud certification (AWS Certified Security – Specialty, AZ-500, Google Professional Cloud Security Engineer) required or obtainable within 6 months.• Ability to explain complex technical designs to engineers, architects, compliance staff, and government stakeholders and produce concise, assessor-ready documentation.• U.S. citizenship is required for this role.PreferredThe base salary for this position will fall between $200,000-$210,000. Your ultimate compensation will be determined by professional background, technical proficiency, seniority, and regional cost factors. Furthermore, this opportunity includes potential eligibility for equity awards and discretionary bonuses, rounding out a comprehensive total rewards offering.Success at 2F Looks Like:• A proactive and solutions oriented mindset• Viewing obstacles as opportunities for growth• Having a bias toward action and tangible, measurable results• Being team-oriented with a focus on personal responsibility and autonomy Perks & Benefits:This role is a full time position. As a public benefit corporation, we’re a team of purpose-driven trailblazers transforming the future of U.S. national security. We hire the best to do their best and, as such, we are committed to providing the perks and benefits you need to be successful—both in- and outside the workplace.Perks of Joining Our Team:• Competitive salary• 100% employer-paid medical, dental, and vision coverage for you and your dependents• 401(k) with a 3% company contribution• Comprehensive wellness benefits, including a One Medical membership, mental health resources, family planning support, and more• Equity incentive plan• New hire technology and home office stipend• Annual professional development stipend• Flexible paid time off, plus all federal holidays• Generous parental leave• Flexible remote work opportunities• Employee referral bonus programVisit our careers page to learn more.Who We Are:Second Front Systems (2F) is a public-benefit software company powering software for the free world. We eliminate the friction that slows innovation, enabling faster, more secure development and deployment of software across government and regulated networks. Built by national security veterans and backed by top-tier venture capital, our platform is trusted by the world’s leading organizations to cut deployment timelines from years to weeks. We move fast, solve hard problems, and deliver trusted capabilities where they’re needed most. Our work strengthens global security and gives the United States and its allies a lasting competitive advantage. Learn more at secondfront.com.Citizenship requirement:This position requires U.S. citizenship due to the nature of our work supporting U.S. government and defense customers.One last thing:We are an equal opportunity employer and all qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity or expression, pregnancy, age, national origin, disability status, genetic information, protected veteran status, or any other characteristic protected by law.Are you ready to join our team:To apply, click the “Apply for This Job” button at the top or bottom of this page and complete the application form. This position will remain open until filled, and applications will be reviewed on a rolling basis.