Security Software Engineer — DoD Cloud & DevSecOps

Eccalon LLC; Hanover (MD); On-site; USD 110,000 - 170,000; Full time

Job summary

Eccalon LLC seeks a Security Software Engineer to build and harden software for DoD programs under CMMC/NIST 800-171 and FedRAMP. You will embed security across the SDLC in a cloud-native AWS/GovCloud and Azure environment.

Design secure architectures, implement IAM and least-privilege controls, perform threat modeling, and lead code reviews and vulnerability management to meet regulatory requirements.

Qualifications

• Bachelor's degree in Computer Science, Engineering, or related field, or equivalent experience.
• 3+ years of software engineering with a security focus.
• Proficiency in one or more languages (JavaScript/TypeScript, Python, Go, C#).
• Experience with secure coding practices and frameworks.
• Knowledge of OWASP Top 10, secure API design, cryptography, and auth patterns.

Responsibilities

• Design secure software with a security-first mindset across the SDLC.
• Apply secure coding standards, threat modeling, and vulnerability mitigation per NIST 800-53 and CMMC controls.
• Conduct architecture reviews and code hardening to address OWASP Top 10 and DoD STIGs.
• Automate security gates in CI/CD (SAST, DAST, dependency scanning, secrets detection).
• Design secure system and API architectures for multi-tenant cloud environments (GCC High, GovCloud).
• Implement IAM controls, JIT provisioning, SSO/SAML/OIDC, and least-privilege models.

Skills

Security-focused software engineering

Secure coding practices

Programming languages

Threat modeling

Cloud security (AWS/Azure)

Education

Bachelor's degree in Computer Science or related field

Tools

SAST/DAST tools

Prisma/Snyk

AWS Security services

FedRAMP/GCC High

Job description

Eccalon LLC seeks a Security Software Engineer to build and harden software for DoD programs under CMMC/NIST 800-171 and FedRAMP. You will embed security across the SDLC in a cloud-native AWS/GovCloud and Azure environment.

Design secure architectures, implement IAM and least-privilege controls, perform threat modeling, and lead code reviews and vulnerability management to meet regulatory requirements.