Senior DoD Product Security Engineer — RMF & ATO Lead

Piper Companies; Clarkburg (MS); Hybrid; USD 145,000 - 175,000; Full time

Benefits offered by this job

Healthcare benefits

Hybrid work model

Job summary

Zachary Piper Solutions seeks a Senior DoD Product Security Engineer to own RMF/ATO activities for DoD programs, across autonomous and embedded systems. You will partner with software, hardware, and DevOps teams to secure the full product lifecycle.

Requirements include 5+ years in security engineering, DoD RMF/ATO experience, and strong knowledge of NIST/DISA STIG standards. Hybrid role based in Clarksburg, MD with 3 days onsite.

Qualifications

• 5+ years of security engineering or related cybersecurity experience.
• Hands-on DoD RMF and ATO lifecycle experience.
• Experience with NIST SPs, DISA STIGs, and eMASS.
• Security across hardware and software environments; embedded/autonomous systems.

Responsibilities

• Lead RMF and ATO activities from initial security controls to authorization.
• Define security architecture across hardware and software systems.
• Work with engineering to embed security in design and development.
• Create and maintain security documentation, POA&Ms, and artifacts.
• Lead threat modeling and risk assessments for autonomous and embedded systems.
• Serve as DISA STIG SME translating requirements into engineering guidance.
• Oversee security monitoring, logging, secure updates, and remediation.
• Support SBOM, software supply-chain security, and secure SDLC/DevSecOps.
• Review embedded and application systems for vulnerabilities; coordinate remediation.

Skills

RMF

ATO lifecycle

NIST 800-37

NIST 800-53

NIST 800-171

DISA STIG

eMASS

SBOM

DevSecOps

SAST

DAST

CI/CD

CMMC

Cryptography

Secure Boot

Firmware Security

C

C++

Python

ARM

x86

CISSP

DoD

Job description

Zachary Piper Solutions seeks a Senior DoD Product Security Engineer to own RMF/ATO activities for DoD programs, across autonomous and embedded systems. You will partner with software, hardware, and DevOps teams to secure the full product lifecycle.

Requirements include 5+ years in security engineering, DoD RMF/ATO experience, and strong knowledge of NIST/DISA STIG standards. Hybrid role based in Clarksburg, MD with 3 days onsite.