Security Software Engineer — DoD/GCC High DevSecOps

Eccalon, LLC; Hanover (MD); On-site; USD 120,000 - 190,000; Full time

Job summary

Eccalon, LLC is seeking a Security Software Engineer to build and harden software systems supporting DoD programs under CMMC/NIST 800-171/FedRAMP.

You will embed security across the SDLC—from design and code review through CI/CD and cloud deployment—working alongside engineering, DevSecOps, and IT teams in a regulated, cloud-native environment (AWS Commercial and GovCloud, Azure GCC High).

Qualifications

• Bachelor’s degree in Computer Science, Engineering, or related field—or equivalent experience.
• 3+ years of software engineering experience with a strong focus on security.
• Experience with secure coding practices and frameworks.
• Strong understanding of application security principles, including OWASP Top 10; Cryptography fundamentals.
• Experience with code scanning tools (SAST/DAST), threat modeling, and penetration testing.
• Familiarity with NIST 800-171, CMMC, or FedRAMP security control requirements and evidence collection.
• Hands-on experience with AWS and/or Azure security services (IAM, WAF, Security Hub, Defender, Sentinel); GCC High or GovCloud experience a plus.

Responsibilities

• Design and develop secure software with a security-first mindset baked into every phase of the SDLC.
• Apply secure coding standards, threat modeling, and vulnerability mitigation aligned to NIST 800-53 and CMMC Level 2/3 controls.
• Conduct architecture reviews and code hardening to address OWASP Top 10 and DoD STIGs.
• Automate security gates in CI/CD pipelines (SAST, DAST, dependency scanning, secrets detection).

Skills

Security-first mindset

Threat modeling

Secure coding practices

SAST/DAST tooling

Cloud security (AWS/Azure)

NIST 800-171 / CMMC

Education

Bachelor’s degree in CS or related field

Tools

SAST tools

DAST tools

CI/CD security tooling

Job description

Eccalon, LLC is seeking a Security Software Engineer to build and harden software systems supporting DoD programs under CMMC/NIST 800-171/FedRAMP.

You will embed security across the SDLC—from design and code review through CI/CD and cloud deployment—working alongside engineering, DevSecOps, and IT teams in a regulated, cloud-native environment (AWS Commercial and GovCloud, Azure GCC High).