Senior API Gateway Security Engineer (RMF/ATO)

BaseCamp Consulting & Solutions; Reston (VA); On-site; USD 120,000 - 180,000; Full time

Job summary

BaseCamp Consulting & Solutions seeks a Senior Cybersecurity Integration Engineer to secure and integrate the enterprise API gateway, drive it through the RMF toward a signed Authority to Operate (ATO), and sustain it with continuous monitoring.

The role combines hands-on security engineering at the API boundary with ownership of the System Security Plan, control narratives, and evidence for RMF; requires an active MBI and US citizenship.

Qualifications

• Eight years of hands-on cybersecurity or integration engineering on enterprise API gateway, IAM, or boundary security platforms in production.
• Experience leading System Security Plans and RMF workflows for Federal systems.
• Strong understanding of API security protocols and federation services.

Responsibilities

• Design and enforce API security policy across authentication, authorization, and token validation.
• Coordinate RMF activities to achieve and sustain ATO for the gateway.
• Author and maintain the SSP and control narratives per NIST 800-53 Rev 5 and related guidance.
• Perform continuous monitoring and vulnerability response across gateway, network, and identity layers.
• Onboard applications and services, coordinating changes with owning teams.

Skills

API gateway security

RMF / ATO

NIST 800-53

FISMA experience

OAuth 2.0 / OpenID Connect

TLS / mTLS

SIEM (Splunk)

System Security Plan

Vulnerability management

Fed compliance

Education

Bachelor's degree in Engineering/CS/C cybersecurity

Tools

eMASS / Xacta / CSAM

CA SiteMinder / Ping Federate

Job description

BaseCamp Consulting & Solutions seeks a Senior Cybersecurity Integration Engineer to secure and integrate the enterprise API gateway, drive it through the RMF toward a signed Authority to Operate (ATO), and sustain it with continuous monitoring.

The role combines hands-on security engineering at the API boundary with ownership of the System Security Plan, control narratives, and evidence for RMF; requires an active MBI and US citizenship.