Security Software Engineer - Cloud Compliance (GovCloud)

Eccalon, LLC; Detroit (MI); On-site; USD 110,000 - 145,000; Full time

Job summary

Eccalon, LLC in Detroit, MI seeks a Security Software Engineer to build and harden software for DoD programs, ensuring compliance with CMMC, NIST 800-171, and FedRAMP in AWS GovCloud and Azure Gov. You will embed security across the SDLC—from design to deployment.

You will lead secure coding, threat modeling, SAST/DAST, and vulnerability remediation, collaborating with DevSecOps and IT, implementing IAM and monitoring, and contributing to audit evidence for compliance.

Qualifications

• Bachelor’s degree in Computer Science, Engineering, or related field—or equivalent experience.
• 3+ years of software engineering with a strong focus on security.
• Experience with secure coding practices and frameworks.
• Familiarity with NIST 800-53, CMMC, or FedRAMP security control requirements.

Responsibilities

• Design and develop secure software with a security-first mindset across the SDLC.
• Apply secure coding standards, threat modeling, and vulnerability mitigation.
• Conduct architecture reviews and code hardening addressing OWASP Top 10 and DoD STIGs.
• Automate security gates in CI/CD pipelines (SAST, DAST, dependency scanning, secrets detection).
• Lead vulnerability management, triage, and remediation within POA&M timelines.
• Collaborate with engineering, DevSecOps, and IT to enforce secure IaC and cloud controls.

Skills

Software engineering

Security mindset

Threat modeling

Code reviews

Education

Bachelor’s degree or equivalent experience

Tools

SAST/DAST tools

Cloud security services

GovCloud/FedRAMP familiarity

Job description

Eccalon, LLC in Detroit, MI seeks a Security Software Engineer to build and harden software for DoD programs, ensuring compliance with CMMC, NIST 800-171, and FedRAMP in AWS GovCloud and Azure Gov. You will embed security across the SDLC—from design to deployment.

You will lead secure coding, threat modeling, SAST/DAST, and vulnerability remediation, collaborating with DevSecOps and IT, implementing IAM and monitoring, and contributing to audit evidence for compliance.