Security Software Engineer — DoD Cloud & DevSecOps

Eccalon, LLC; Detroit (MI); On-site; USD 110,000 - 165,000; Full time

Job summary

Eccalon, LLC in Detroit seeks a Security Software Engineer to build and harden software for DoD programs under CMMC/NIST 800-171/FedRAMP. You will embed security across the SDLC in a cloud-native environment (AWS GovCloud and Azure).

You will work with engineering, DevSecOps and IT to design secure architectures, perform threat modeling, conduct code reviews, and automate security gates in CI/CD pipelines. The role requires hands-on security in multi-tenant cloud platforms and a commitment to

Qualifications

• Bachelor's degree in Computer Science, Engineering, or related field, or equivalent experience.
• 3+ years of software engineering with a strong security focus.
• Proficiency in JavaScript/TypeScript, Python, Go, or C#.
• Experience with secure coding practices and frameworks.
• Knowledge of OWASP Top 10, secure API/REST design, cryptography, and auth patterns.
• Experience with SAST/DAST, threat modeling, and penetration testing.
• Familiarity with NIST 800-171, CMMC, or FedRAMP requirements and evidence collection.
• Hands-on experience with AWS and/or Azure security services; GCC High or GovCloud a plus.

Responsibilities

• Design and develop secure software with security-first mindset baked into every phase of the SDLC.
• Implement IAM controls, SSO/SAML/OIDC flows, and least-privilege in multi-tenant cloud environments.
• Lead code reviews, SAST/DAST scans, and targeted penetration testing; document findings against controls.
• Collaborate with DevOps/SRE to enforce secure IaC, WAF rules, and runtime monitoring across AWS/Azure.

Skills

JavaScript/TypeScript

Python

Go

C#

Education

Bachelor's degree in CS/Engineering

Tools

SAST/DAST tools

Threat modeling

Penetration testing

AWS security services

Azure security services

CI/CD security tooling

Job description

Eccalon, LLC in Detroit seeks a Security Software Engineer to build and harden software for DoD programs under CMMC/NIST 800-171/FedRAMP. You will embed security across the SDLC in a cloud-native environment (AWS GovCloud and Azure).

You will work with engineering, DevSecOps and IT to design secure architectures, perform threat modeling, conduct code reviews, and automate security gates in CI/CD pipelines. The role requires hands-on security in multi-tenant cloud platforms and a commitment to