Security Software Engineer: Cloud-Native & DoD-CMMC Expert

Eccalon, LLC; Hanover (MD); On-site; USD 120,000 - 180,000; Full time

Job summary

Eccalon, LLC is seeking a Security Software Engineer to build and harden software systems for DoD programs, ensuring compliance with CMMC/NIST 800-171 and FedRAMP. You will embed security across the SDLC in a cloud-native AWS/Azure environment and collaborate with DevSecOps, engineering, and IT teams.

Ideal candidates have hands-on security experience in CI/CD, threat modeling, vulnerability management, and secure IaC, with a track record of secure design and code reviews in regulated

Qualifications

• Bachelor’s degree or equivalent experience in a technical field.
• 3+ years of software engineering experience with a strong focus on security.
• Experience with secure coding practices and frameworks.
• Strong understanding of application security principles, including OWASP Top 10 and cryptography fundamentals.
• Experience with code scanning tools (SAST/DAST), threat modeling, and penetration testing.
• Familiarity with NIST 800-171, CMMC, or FedRAMP security control requirements and evidence collection.
• Hands-on experience with AWS and/or Azure security services (IAM, WAF, Security Hub, Defender, Sentinel).

Responsibilities

• Design and develop secure software with a security-first mindset baked into every phase of the SDLC.
• Apply secure coding standards, threat modeling, and vulnerability mitigation aligned to NIST 800-53 and CMMC Level 2/3 controls.
• Conduct architecture reviews and code hardening to address OWASP Top 10 and DoD STIGs.
• Automate security gates in CI/CD pipelines (SAST, DAST, dependency scanning, secrets detection).
• Design secure system and API architectures for multi-tenant cloud environments, including GCC High and FedRAMP-authorized platforms.
• Implement IAM controls, JIT provisioning, SSO/SAML/OIDC flows, and least-privilege authorization frameworks (e.g., Cognito, Azure AD).
• Instrument applications with security logging and monitoring that satisfies audit and continuous monitoring requirements (AU/SI control families).
• Lead code reviews, SAST/DAST scans, and targeted penetration testing; document findings against control frameworks.
• Triage and remediate vulnerabilities within POA&M timelines; maintain artifact evidence for compliance assessments.
• Support incident response for application-layer events; contribute to after-action reports and corrective action plans.
• Serve as the embedded security champion for engineering squads, raising the security bar through mentorship and code review culture.
• Develop and deliver security training and runbooks tailored to engineering and DevOps team members.
• Collaborate with DevOps/SRE to enforce secure IaC, WAF rules, network controls, and runtime monitoring across AWS and Azure environments.

Skills

Security-minded software development

Threat modeling

Secure coding practices

Code reviews

Education

Bachelor’s degree in Computer Science, Engineering, or related field—or equivalent experience

Tools

SAST

DAST

AWS Security Services

Azure Security Services

FedRAMP/GCC High knowledge

Job description

Eccalon, LLC is seeking a Security Software Engineer to build and harden software systems for DoD programs, ensuring compliance with CMMC/NIST 800-171 and FedRAMP. You will embed security across the SDLC in a cloud-native AWS/Azure environment and collaborate with DevSecOps, engineering, and IT teams.

Ideal candidates have hands-on security experience in CI/CD, threat modeling, vulnerability management, and secure IaC, with a track record of secure design and code reviews in regulated