Information Systems Security Engineer

Second Front Systems; Washington (District of Columbia); Hybrid; USD 200,000 - 210,000; Full time

Benefits offered by this job

100% employer-paid medical, dental,和视力

401(k) with 3% company contribution

Wellness benefits and One Medical

Equity incentive plan

New hire technology and home office 1

Annual professional development

Flexible PTO and federal holidays

Parental leave

Flexible remote work opportunities

Referral bonus

Job summary

Second Front Systems is seeking an Information Systems Security Engineer to own security architecture and RMF compliance for the Game Warden platform and hosted customer apps. You will design secure-by-design solutions and translate engineering decisions into RMF artifacts and authorization evidence, ensuring alignment with DoD ICAM and Zero Trust.

You will lead identity management, boundary diagrams, and data flow analyses, working with ISSMs, ISSOs, and assessors to support assessments,

Qualifications

• Active U.S. Secret clearance required.
• DoD 8570 IASAE Level II certification required or obtainable within 90 days.
• Cloud security certifications (AWS/Azure/GCP) required or obtainable within 6 months.
• 5–8 years in security engineering or cloud security architecture.
• Minimum 4 years designing production workloads in AWS/Azure/GCP.
• Minimum 3 years supporting DoD/federal RMF authorizations.
• Fluent in SSO/federation, MFA, RBAC/ABAC, privileged access and cloud IAM.
• Translate designs into RMF artifacts, SSP, PPSM, AO review.

Responsibilities

• Architect identity and access management designs across federation, MFA, privileged access in AWS, Azure, GCP.
• Build authorization boundary diagrams showing trust boundaries and data flows.
• Translate decisions into RMF artifacts and SSP content for assessments.
• Evaluate designs against NIST 800-53, DISA SRG, STIGs, and FedRAMP.
• Govern security impact of architecture changes and integrations with customers.
• Coordinate with Solutions Architects to embed security from onboarding onward.
• Establish Zero Trust guardrails and compliance‑as‑code in cloud environments.
• Serve as SME during assessments and audits.

Skills

Identity and access management

Cloud security architecture

RMF / NIST 800-53

DoD security clearance

Communication with stakeholders

Architecture diagrams

Zero Trust

GRC tools (eMASS)

Education

DoD 8570/8140 IASAE Level II

CISSP/CASP/CSSLP

AWS/Azure/GCP Cloud Security Certification

Tools

Lucidchart

draw.io

Visio

AWS IAM

GCP IAM

Azure RBAC

KMS/HSM

Job description

Information Systems Security Engineer

Second Front Systems is looking for a technically deep, mission-focused, security-first Information Systems Security Engineer to strengthen our cybersecurity and solutions architecture practice. Operating at the boundary between engineering delivery and DoD authorization, you will be responsible for owning the security architecture and compliance engineering view of 2F's Game Warden platform and customer applications it hosts. You will work side by side with Solutions Architects and customers to design secure-by-design solutions and translate engineering decisions into RMF artifacts, control narratives, and authorization evidence, ensuring that solutions are defensible under DoD RMF and hold up to assessor and Authorizing Official review. We need someone capable of designing and validating identity and access management flows (federation, SAML, OIDC/OAuth 2.0, cloud IAM, DoD PKI/CAC, privileged access) aligned with DoD ICAM and Zero Trust; producing clear authorization boundary diagrams, network architecture diagrams, and data‑flow diagrams that trace CUI and sensitive data end to end; and translating technical architectures into NIST 800-53 control implementations, SSP sections, PPSM registrations, and significant change impact analyses. As a key partner to ISSMs, ISSOs, assessors, Authorizing Officials, and engineering teams, you will serve as the technical subject matter expert during assessments, readiness reviews, and audits, and advance secure-by-design and compliance-as-code practices across cloud-native environments, serving as the bridge between architecture decisions and authorization boundaries.

Note:

• DC/Maryland/Virginia
• Denver/Colorado Springs, CO

This is a full-time position.

What You'll Do

• Architect identity and access management designs covering federation, MFA, RBAC/ABAC, privileged access, and DoD PKI/CAC authentication across AWS, Azure, and GCP.
• Build and maintain authorization boundary diagrams, network architecture diagrams, and data‑flow diagrams showing components, trust boundaries, ports, protocols, and movement of CUI and sensitive data.
• Translate engineering and architecture decisions into RMF artifacts including SSP architecture sections, AC/IA/SC/AU control narratives, PPSM registrations, and significant change impact analyses.
• Evaluate proposed designs and new services against NIST 800-53, DISA Cloud Computing SRG, STIGs, and FedRAMP requirements and recommend compliant alternatives.
• Govern security and authorization impact of architecture changes, customer integrations, and new services, advising ISSMs and ISSOs on significance and re‑authorization requirements.
• Synchronize with Solutions Architects and customer architects during onboarding, design, and change activities to embed security and authorization requirements from first conversation.
• Establish Zero Trust principles, infrastructure‑as‑code guardrails, and compliance‑as‑code practices to enforce and evidence security controls automatically in cloud‑native environments.
• Own the technical subject matter expert role during assessments, readiness reviews, and audits, walking SCAs and Authorizing Officials through architecture and identity design.

What You Bring

• 5–8 years of hands‑on security engineering, cloud security architecture, or information assurance; minimum 4 years designing and securing production workloads in AWS, Azure, or GCP; minimum 3 years supporting DoD or federal authorizations under RMF.
• Expert fluency in identity and access management: SSO and federation (SAML, OIDC/OAuth 2.0), MFA, RBAC/ABAC, privileged access management, cloud-native IAM (AWS IAM, GCP IAM, Azure RBAC), and DoD PKI/CAC authentication.
• Extensive hands‑on experience architecting and securing AWS, Azure, and/or GCP environments including VPC/VNet design, cloud IAM and account structure, encryption and key management (KMS/HSM), logging and monitoring, native security services (GuardDuty, Security Hub, Defender for Cloud), GovCloud, and cloud-native patterns (containers, Kubernetes, CI/CD).
• Demonstrated ability to produce clear, accurate architecture, authorization boundary, and data‑flow diagrams suitable for authorization packages and assessor review using tools such as Lucidchart, draw.io, or Visio.
• Strong working knowledge of NIST 800‑37 (RMF) and NIST 800‑53 (Rev 4/5) with ability to translate technical designs into control implementations, SSP content, and RMF workflows in eMASS or similar GRC tools.
• Familiarity with DISA PPSM, CAL, DISA Cloud Computing SRG, STIGs, DoD ICAM policy, and DoD Zero Trust Reference Architecture.
• Active U.S. Secret security clearance required; DoD 8570/8140 IASAE Level II baseline certification (CISSP, CASP+, CSSLP) required or obtainable within 90 days; at least one professional‑level cloud certification (AWS Certified Security – Specialty, AZ‑500, Google Professional Cloud Security Engineer) required or obtainable within 6 months.
• Ability to explain complex technical designs to engineers, architects, compliance staff, and government stakeholders and produce concise, assessor‑ready documentation.
• U.S. citizenship is required for this role.

Preferred

The base salary for this position will fall between $200,000-$210,000. Your ultimate compensation will be determined by professional background, technical proficiency, seniority, and regional cost factors. Furthermore, this opportunity includes potential eligibility for equity awards and discretionary bonuses, rounding out a comprehensive total rewards offering.

Success at 2F Looks Like:

• A proactive and solutions oriented mindset
• Viewing obstacles as opportunities for growth
• Having a bias toward action and tangible, measurable results
• Being team‑oriented with a focus on personal responsibility and autonomy

Perks & Benefits

This role is a full time position. As a public benefit corporation, we’re a team of purpose‑driven trailblazers transforming the future of U.S. national security. We hire the best to do their best and, as such, we are committed to providing the perks and benefits you need to be successful—both in‑and outside the workplace.

Perks of Joining Our Team

• Competitive salary
• 100% employer‑paid medical, dental, and vision coverage for you and your dependents
• 401(k) with a 3% company contribution
• Comprehensive wellness benefits, including a One Medical membership, mental health resources, family planning support, and more
• Equity incentive plan
• New hire technology and home office stipend
• Annual professional development stipend
• Flexible paid time off, plus all federal holidays
• Generous parental leave
• Flexible remote work opportunities
• Employee referral bonus program

Visit our careers page to learn more.

Who We Are

Second Front Systems (2F) is a public‑benefit software company powering software for the free world. We eliminate the friction that slows innovation, enabling faster, more secure development and deployment of software across government and regulated networks. Built by national security veterans and backed by top‑tier venture capital, our platform is trusted by the world’s leading organizations to cut deployment timelines from years to weeks. We move fast, solve hard problems, and deliver trusted capabilities where they’re needed most. Our work strengthens global security and gives the United States and its allies a lasting competitive advantage. Learn more at secondfront.com.

Citizenship requirement

This position requires U.S. citizenship due to the nature of our work supporting U.S. government and defense customers.

One last thing

We are an equal opportunity employer and all qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity or expression, pregnancy, age, national origin, disability status, genetic information, protected veteran status, or any other characteristic protected by law.

State notices

Colorado: In accordance with Colorado law, applicants may redact their date of birth, dates of attendance, and dates of graduation from any uploaded documents.

Maryland: Under Maryland law, an employer may not require or demand, as a condition of employment, prospective employment, or continued employment, that an individual submit to or take a polygraph examination or similar test. An employer who violates this law is guilty of a misdemeanor and subject to a fine not exceeding $100.