Senior DoD Product Security Engineer

Zachary Piper Solutions; Clarksburg (MD); Hybrid; USD 145,000 - 175,000; Full time

Benefits offered by this job

Cigna Medical, Dental, and Vision

401(k)

Paid Holidays

Sick Leave (where required by law)

Company-sponsored benefits

Job summary

Zachary Piper Solutions is seeking a Senior DoD Product Security Engineer to join a leading defense technology company in Clarksburg, MD. This hybrid role requires 3 days onsite and 2 days remote per week and focuses on securing autonomous and embedded platforms across the product lifecycle.

You will lead RMF and ATO activities for mission critical DoD programs, define security architectures and control implementations, and partner with software, hardware, and DevOps teams to ensure

Qualifications

• Bachelor's degree in a technical field (Cybersecurity, CS, or engineering).
• 5+ years in cybersecurity or product security roles.
• Experience securing DoD RMF and ATO lifecycles.
• Knowledge of NIST 800-37/53/171, DISA STIGs, eMASS.
• Experience with embedded/mission-critical systems.
• Ability to derive security requirements and communicate with engineers.
• SBOM, software supply-chain security, and secure SDLC familiarity.
• SAST, DAST, code reviews, CI/CD, and DevSecOps familiarity.

Responsibilities

• Lead RMF and ATO activities for DoD programs.
• Define security architectures and controls across software/hardware.
• Partner with engineering to embed security in design and development.
• Develop and maintain SSPs, POA&Ms, evidence packages, and artifacts.
• Conduct threat modeling, risk assessments, and attack surface analysis.
• Serve as DISA STIG SME and translate requirements to engineering.
• Oversee vulnerability management, monitoring, and remediation.
• Support SBOM generation and secure software supply chain.
• Review software and firmware for vulnerabilities and risks.
• Act as primary cybersecurity interface for government customers.

Skills

RMF

ATO

Threat Modeling

Vulnerability Management

SBOM

Secure SDLC

CMMC

DevSecOps

CISSP

Cryptography

Education

Bachelor's degree in Cybersecurity

Tools

eMASS

SAST

DAST

Job description

Senior DoD Product Security Engineer

Zachary Piper Solutions is seeking a Senior DoD Product Security Engineer to join a leading Defense Technology Company specializing in autonomous systems and advanced technologies supporting Department of Defense programs. This is a hybrid position based in Clarksburg, MD, requiring 3 days onsite and 2 days remote per week.

The Senior DoD Product Security Engineer will be responsible for securing autonomous and embedded platforms across the product lifecycle while leading RMF and ATO activities for mission-critical defense programs. This role will partner closely with software, hardware, systems, and DevOps engineering teams to ensure cybersecurity requirements are integrated into product architecture, development, and deployment efforts.

Responsibilities

• Lead RMF and ATO activities for assigned DoD programs through successful authorization.


• Define security architectures, control implementations, and cybersecurity requirements across software and hardware systems.


• Partner with engineering teams to incorporate security requirements throughout product design and development.


• Develop and maintain SSPs, POA&Ms, security evidence packages, and authorization artifacts.


• Conduct threat modeling, risk assessments, and attack surface analysis for autonomous and embedded systems.


• Serve as a DISA STIG subject matter expert and translate security requirements into engineering solutions.


• Oversee vulnerability management, security monitoring, logging, and remediation activities.


• Support SBOM generation, software supply-chain security initiatives, and secure SDLC processes.


• Review application, firmware, and embedded systems for vulnerabilities and compliance risks.


• Act as a primary cybersecurity interface for government customers, assessors, and program leadership.

Required Qualifications

• Bachelor's degree in Cybersecurity, Computer Science, Engineering, Information Systems, or a related technical field.


• 5+ years of cybersecurity, product security, systems security, or security engineering experience.


• Hands‑on experience supporting DoD RMF and ATO lifecycle activities.


• Strong knowledge of NIST 800-37, NIST 800-53, NIST 800-171, DISA STIGs, and eMASS.


• Experience securing embedded, autonomous, disconnected, or mission‑critical operational systems.


• Ability to develop technical security requirements and communicate effectively with engineering organizations.


• Experience with vulnerability management, SBOMs, software supply‑chain security, and secure SDLC practices.


• Familiarity with SAST, DAST, code reviews, CI/CD pipelines, and DevSecOps methodologies.


• Knowledge of cryptographic technologies, secure boot architectures, signed firmware, and key management solutions.

Preferred Qualifications

• Experience owning and maintaining a DoD ATO through the complete authorization lifecycle.


• Familiarity with CMMC compliance requirements.


• Working knowledge of ISO/SAE 21434 and/or IEC 62443 security frameworks.


• Experience securing industrial, embedded, disconnected, or operational technology environments.


• CISSP, Security+, CASP+, or comparable cybersecurity certifications.


• Experience with offensive security testing, fuzzing, exploit development, reverse engineering, or vulnerability research.


• Hands‑on programming experience with C, C++, Python, ARM, x86, and secure software development practices.

Compensation & Benefits

• Salary Range: $145,000 - $175,000


• Comprehensive benefits package including:
  
  
  
  • Cigna Medical, Dental, and Vision
  
  
  • 401(k)
  
  
  • Paid Holidays
  
  
  • Sick Leave (where required by law)
  
  
  • Additional company-sponsored benefits
  
  
  
  

Keywords

Senior Product Security Engineer, DoD Product Security Engineer, Cybersecurity Engineer, Product Security, RMF, Risk Management Framework, ATO, Authority to Operate, eMASS, NIST 800-37, NIST 800-53, NIST 800-171, DISA STIG, POA&Ms, SSP, Embedded Security, Autonomous Systems Security, Mission Systems Security, Threat Modeling, Vulnerability Management, SBOM, Supply Chain Security, Secure SDLC, DevSecOps, SAST, DAST, CI/CD, CMMC, Cryptography, Secure Boot, Firmware Security, Reverse Engineering, Fuzzing, CISSP, Defense Technology, Embedded Systems, Secret Clearance.

#LI-JL1