Senior Security Engineer (Cleared)

Rise8; Colorado Springs, Los Angeles (CO, CA); Hybrid; USD 144,000 - 180,000; Full time

Benefits offered by this job

Premium Insurance

401k match

Paid time off

Education & Training budget

Home office stipend

Wellness budget

MacBook Pro

Job summary

Rise8 is seeking a Senior Security Engineer to own security across the build pipeline and authorization packages. You will design and harden AWS GovCloud/Azure GCC High infrastructure, implement Zero Trust in code, and automate evidence gathering for continuous risk reduction.

This hands-on role blends security and compliance within delivery, enabling continuous delivery and continuous compliance across programs. You will mentor others while advancing program-wide security maturity.

Qualifications

• 6–10 years of experience in cloud/security engineering or DevSecOps.
• Deep fluency with major cloud platforms (AWS GovCloud, Azure GCC High).
• Hands-on production CI/CD security experience.
• Infrastructure as Code (Terraform) as standard for infra and controls.
• Direct experience applying control frameworks (NIST 800-53, FedRAMP, CMMC).
• Strong programming ability in Python, Go or Rust to build security tools.

Responsibilities

• Own delivery pipeline and cloud infrastructure security for production software.
• Translate control frameworks into automated checks and guardrails.
• Drive Continuous ATO/cATO adoption and evidence collection.
• Lead adoption of AI-driven security tooling with rigorous engineering judgment.

Skills

Cloud security

DevSecOps

Python

Go

Rust

Terraform

NIST 800-53

FedRAMP

CMMC

Security engineering

Tools

Kyverno

OPA Gatekeeper

Terraform

AWS GovCloud

Azure GCC High

Job description

Your Dream. Our Team.

About Rise8

Rise8 builds custom, secure software for government organizations, measuring success by impact: lives saved, time returned, and missions advanced.

We think big, start small, and scale fast with elite teams across product, design, and engineering to drive continuous delivery for critical missions.

We believe customer experience starts with employee experience, so we take care of our employees. Rise8 is where you’ll do the best work of your career - supported by a culture you won’t find anywhere else. We offer competitive pay and benefits, but what sets us apart is our commitment to autonomy, growth, and a culture rooted in kindness, candor, and continuous learning.

Certified as a Great Place to Work®, with 100% of employees saying they love working here, Rise8 is where bold ideas become real capabilities. Where mission meets meaning. And where fewer bad things happen because of bad software.

About the role

We are hiring a Senior Security Engineer to own security across both the build pipeline and the authorization package across multiple teams and program domains. You will design and harden the cloud infrastructure and CI/CD that ships our software, translate whole regulatory frameworks into code, drive program-wide Continuous ATO (cATO) adoption, and automate evidence gathering for data-driven risk reduction.

This is hands-on engineering focused. Most organizations split this work between a security engineer who’s abstracted from compliance and a compliance SME who rarely works embedded within the development team. With compliance and authorizations viewed as a part of continuous delivery and continuous compliance, these roles are blended into one. As a Senior Security Engineer, you own the outcomes for security and compliance for delivery.

What you will own

Delivery pipeline and cloud infrastructure

• Own the CI/CD pipelines that deliver production software across teams, including build integrity, SLSA artifact signing, and least-privilege pipeline credentials.
• Set the secure golden path patterns and landing zone architectures across AWS GovCloud / Azure GCC High environments, enforcing Zero Trust principles in code.
• Secure the software supply chain across the program: dependency scanning, secret detection, SBOM generation, provenance verification, and pinned build actions.
• Harden container and orchestration layers from base image selection through admission control policies (Kyverno, OPA Gatekeeper).

Controls as code

• Translate whole control frameworks (NIST 800-53, CMMC, FedRAMP, DISA CC SRG) into automatable technical checks, building implementations rather than documenting manual processes.
• Decide where control gates sit and what they block, ensuring changes that break controls fail builds automatically before reaching assessment.
• Threat model complex distributed systems and carry mitigations directly through to running code and automated guardrails.
• Build and lead the adoption of agentic/AI-driven security tooling across teams, applying rigorous engineering judgment to AI safety and utility.

Evidence and authorization

• Own the evidence system across the program, establishing continuous collection from cloud APIs, CI/CD runners, and scanner feeds so posture derives from live data.
• Author control implementation statements and inherited-versus-owned boundary splits at a level of quality that assessors accept without rework.
• Drive Continuous RMF and cATO practices, keeping security posture reportable on demand and maintaining real-time POA&M status.
• Implement unified control libraries so a single technical check satisfies NIST 800-53, SOC 2, and ISO 27001 simultaneously.
• Train, mentor, and foster growth for security engineers across the practice.

What we need you to have

• 6–10 years of experience in cloud/platform operations, DevSecOps, or security engineering.
• Deep technical fluency in the security surface of major cloud platforms (AWS GovCloud, Azure GCC High), including where default settings are insecure.
• Hands-on pipeline construction: you have built and hardened production CI/CD platforms, not merely consumed them.
• Infrastructure as Code (Terraform) as your standard method for managing infrastructure and security controls.
• Direct experience applying control frameworks (NIST 800-53, FedRAMP, CMMC) to real production systems.
• Strong programming capability in Python, Go, or Rust at the level required to build custom security tools, admission controllers, and evidence pipelines.
• The ability to hold both vocabularies fluently: stating controls to developers as system requirements and pipeline gates to assessors as control satisfaction.

Certifications & DoD 8140 Compliance

• Rise8 Standard: No certification is required to interview or receive an offer. We evaluate candidates on practical engineering capabilities, code delivery, and compliance problem-solving - not test scores.
• Contract Requirements (DoD 8140 / 8570): Specific customer engagements and Department of Defense programs may require an approved baseline certification (e.g., DoD 8140.03 / 8570.01-M) to obtain elevated administrative privileges or access to customer enclaves. Candidates already holding an applicable certification will be eligible for immediate deployment to these contracts. For candidates hired without one, Rise8 will support and sponsor obtaining the required credential if assigned to a billable role that mandates it.
• Relevant baseline credentials worth mentioning (DoD IAT Level III / CSSP / IAM Level III aligned): CISSP, CKS, CCSP, AWS Security - Specialty, Red Hat RHCE, GIAC (GSLC/GCIH), or equivalents.

What helps

• Direct experience carrying an ATO or cATO package end to end (SSP authoring, POA&M management, continuous monitoring).
• Experience in Federal Agency Environments (CMS, VA, IRS, DOC, DOJ, etc.)
• Experience in DoD Software Factory environments (Platform One, Space CAMP, Kessel Run) and Impact Level (IL4/IL5/IL6) requirements.
• Experience in either private or public sector GRC Engineering.

Travel

Position may require up to 25% travel in support of contract performance, customer site visits, and program activities.

The annual salary range for this role as it is posted is $143,824 - $179,780 regardless of final candidate location within the United States. The final job level and annual salary will be determined based on the education, qualification, knowledge, skills, ability, and experience of the final candidate(s), and calibrated against relevant market data and internal team equity.

• Flexible schedule in a 100% distributed workforce
• Premium Insurance: We cover up to 100% of the employee premium and up to 80% of the combined dependent premium on our base health plan, depending on pay band. We also cover 100% of the premium for employee and dependent Dental and Vision as well as employee premiums for Life and Disability coverage.
• Retirement: 401k match at 10% gross pay.
• Paid time off (PTO): 4 weeks combined accrued vacation and sick leave, 11 Federal holidays, your birthday, jury duty, and bereavement.
• Education & Training: Accrued budget of up to $3,500 per year for classes, travel, events, and materials.
• Home Office and Merch: We offer $750 per year for home office technology and equipment as well as $100 per year for Rise8 merch from our Swag Store.
• Wellness Budget: To encourage and support a well-rounded healthy lifestyle, we cover 100% reimbursement on a variety of wellness activities and products, up to $500 per calendar year.
• Rise8 is part of the Life Time Corporate Partner program. In lieu of your $500 annual wellness benefit, you can instead get a $75 monthly credit towards a Life Time membership ($900 annual benefit).
• Equipment: We offer a MacBook Pro

All of Rise8’s work in this area is with Federal Government customers that require our employees involved with their projects be U.S. citizens. As such, this role requires U.S. citizenship. If hired, you would also be required to go through a background investigation.

Rise8 is an Equal Employment Opportunity employer that will consider you for this role regardless of race, color, religion, gender, sexual orientation, marital status, gender identity or expression, national origin, genetics, age, disability status, protected veteran status, or any other characteristic protected by applicable law.