Senior Security & Compliance Engineer

LMI Consulting, LLC; Arlington (VA); On-site; USD 160,000 - 190,000; Full time

Job summary

LMI Consulting, LLC in Arlington, VA seeks a Senior Security & Compliance Engineer to secure our platform for onboarding, deploying, and hosting third-party applications for HQDA G-4. The role focuses on turning security requirements into automated checks, evidence, and actionable findings for government decisions.

The position requires hands-on engineering with DoD RMF/ATO experience, cloud security expertise, and scripting to automate validation. Active Secret clearance is required.

Qualifications

• Bachelor's degree or equivalent practical experience.
• Eight or more years of experience in security engineering, cloud security, DevSecOps, or federal authorization.
• Demonstrated experience supporting DoD RMF and ATO activities.
• Strong knowledge of NIST security controls and federal cybersecurity requirements.
• Experience securing cloud-hosted or enterprise application platforms.
• Experience assessing third-party software against security controls, deployment requirements, and vulnerability findings.
• Hands-on software engineering or scripting experience used to automate security control validation, evidence collection, vulnerability checks, or monitoring.
• Ability to work directly with platform engineers, application teams, government personnel, and vendor representatives.
• Active Secret clearance.

Responsibilities

• Lead the security engineering and documentation that support the platform's Risk Management Framework and Authority to Operate activities.
• Maintain the platform security baseline, control evidence, authorization documentation, and continuous monitoring approach.
• Map controls provided by the common platform and identify the application-specific controls each third-party vendor must satisfy.
• Assess third-party applications against prescribed security controls and deployment and hosting standards.
• Review security evidence, test results, and vulnerability findings; document gaps, risk, and criteria for remediation.
• Provide government personnel with clear findings and technical recommendations so they can coordinate remediation with third-party vendors. Validate remediation evidence before deployment or continued hosting.
• Integrate security checks, evidence collection, and monitoring into platform delivery and operations where practical.
• Communicate security posture and unresolved risks to government and program leadership.

Skills

Security engineering

Cloud security

DevSecOps

Automation scripting

Government communications

Team collaboration

Active Secret clearance

Education

Bachelor's degree in cybersecurity, computer science, engineering, or related field

Tools

AWS

Cloud security tooling

Automation tooling

Job description

Senior Security & Compliance Engineer

Job Locations

US-VA-Arlington

Overview

LMI is seeking a Staff Security & Compliance Engineer to secure a common platform for onboarding, deploying, and hosting third‑party applications in support of HQDA G-4. This engineer will support the platform's authorization, maintain its security controls, and assess whether applications meet prescribed controls and hosting standards before deployment and during operations.

This is a hands‑on role for an engineer who can turn security requirements into automated checks, clear findings, and actionable evidence for government decisions.

LMI is a new breed of digital solutions provider dedicated to accelerating government impact with innovation and speed. Investing in technology and prototypes ahead of need, LMI brings commercial‑grade platforms and mission‑ready AI to federal agencies at commercial speed.

Leveraging our mission‑ready technology and solutions, proven expertise in federal deployment, and strategic relationships, we enhance outcomes for the government, efficiently and effectively. With a focus on agility and collaboration, LMI serves the defense, space, healthcare, and energy sectors‑helping agencies navigate complexity and outpace change. Headquartered in Tysons, Virginia, LMI is committed to delivering impactful results that strengthen missions and drive lasting value.

Responsibilities

• Lead the security engineering and documentation that support the platform's Risk Management Framework and Authority to Operate activities.
• Maintain the platform security baseline, control evidence, authorization documentation, and continuous monitoring approach.
• Map controls provided by the common platform and identify the application‑specific controls each third‑party vendor must satisfy.
• Assess third‑party applications against prescribed security controls and deployment and hosting standards.
• Review security evidence, test results, and vulnerability findings; document gaps, risk, and criteria for remediation.
• Provide government personnel with clear findings and technical recommendations so they can coordinate remediation with third‑party vendors. Validate remediation evidence before deployment or continued hosting.
• Integrate security checks, evidence collection, and monitoring into platform delivery and operations where practical.
• Communicate security posture and unresolved risks to government and program leadership.

Qualifications

Minimum Qualifications

• Bachelor's degree in cybersecurity, computer science, engineering, or a related field, or equivalent practical experience.
• Eight or more years of experience in security engineering, cloud security, DevSecOps, or federal authorization.
• Demonstrated experience supporting DoD RMF and ATO activities.
• Strong knowledge of NIST security controls and federal cybersecurity requirements.
• Experience securing cloud‑hosted or enterprise application platforms.
• Experience assessing third‑party software against security controls, deployment requirements, and vulnerability findings.
• Hands‑on software engineering or scripting experience used to automate security control validation, evidence collection, vulnerability checks, or monitoring.
• Ability to work directly with platform engineers, application teams, government personnel, and vendor representatives.
• Active Secret clearance.

Preferred Qualifications

• Experience supporting the U.S. Army.
• Experience with AWS or another secure government cloud environment.
• Familiarity with policy as code, automated evidence collection, and continuous monitoring.
• Experience with container security, vulnerability management, identity, logging, or cloud security tooling.
• CISSP, Security+, or another relevant cybersecurity certification.

The target salary range for this position is $160,000 - $190,000.

The salary range displayed represents the typical salary range for this position and is not a guarantee of compensation. Individual salaries are determined by various factors including, but not limited to location, internal equity, business considerations, client contract requirements, and candidate qualifications, such as education, experience, skills, and security clearances

Applicants must meet eligibility requirements for a U.S. Government security clearance. Only U.S. citizens are eligible for a security clearance. For this position, LMI will only consider applicants with an active Secret clearance or higher.

Equal Opportunity Employer

LMI is an Equal Opportunity Employer. LMI is committed to the fair treatment of all and to our policy of providing applicants and employees with equal employment opportunities. LMI recruits, hires, trains, and promotes people without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, pregnancy, disability, age, protected veteran status, citizenship status, genetic information, or any other characteristic protected by applicable federal, state, or local law. If you are a person with a disability needing assistance with the application process, please contact [e-mail]

Colorado Residents: In any materials you submit, you may redact or remove age‑identifying information such as age, date of birth, or dates of school attendance or graduation. You will not be penalized for redacting or removing this information.