Information Systems Security Engineer

📋 Job Overview

Second Front Systems is looking for a technically deep, mission-focused, security-first Information Systems Security Engineer to strengthen our cybersecurity and solutions architecture practice. Operating at the boundary between engineering delivery and DoD authorization, you will be responsible for owning the security architecture and compliance engineering view of 2F's Game Warden platform and customer applications it hosts. You will work side by side with Solutions Architects and customers to design secure-by-design solutions and translate engineering decisions into RMF artifacts, control narratives, and authorization evidence, ensuring that solutions are defensible under DoD RMF and hold up to assessor and Authorizing Official review.

🏢 About Second Front Systems

Second Front Systems is a company focused on strengthening cybersecurity and solutions architecture practice.

🎯 The Role

You will be responsible for owning the security architecture and compliance engineering view of 2F's Game Warden platform and customer applications it hosts. You will work side by side with Solutions Architects and customers to design secure-by-design solutions and translate engineering decisions into RMF artifacts, control narratives, and authorization evidence, ensuring that solutions are defensible under DoD RMF and hold up to assessor and Authorizing Official review.

✅ Key Responsibilities

• Architect identity and access management designs covering federation, MFA, RBAC/ABAC, privileged access, and DoD PKI/CAC authentication across AWS, Azure, and GCP.
• Build and maintain authorization boundary diagrams, network architecture diagrams, and data-flow diagrams showing components, trust boundaries, ports, protocols, and movement of CUI and sensitive data.
• Translate engineering and architecture decisions into RMF artifacts including SSP architecture sections, AC/IA/SC/AU control narratives, PPSM registrations, and significant change impact analyses.
• Evaluate proposed designs and new services against NIST 800-53, DISA Cloud Computing SRG, STIGs, and FedRAMP requirements and recommend compliant alternatives.
• Govern security and authorization impact of architecture changes, customer integrations, and new services, advising ISSMs and ISSOs on significance and re-authorization requirements.
• Synchronize with Solutions Architects and customer architects during onboarding, design, and change activities to embed security and authorization requirements from first conversation.
• Establish Zero Trust principles, infrastructure-as-code guardrails, and compliance-as-code practices to enforce and evidence security controls automatically in cloud-native environments.
• Own the technical subject matter expert role during assessments, readiness reviews, and audits, walking SCAs and Authorizing Officials through architecture and identity design.

📌 Required Qualifications

• 5–8 years of hands-on security engineering, cloud security architecture, or information assurance; minimum 4 years designing and securing production workloads in AWS, Azure, or GCP; minimum 3 years supporting DoD or federal authorizations under RMF.
• Expert fluency in identity and access management: SSO and federation (SAML, OIDC/OAuth 2.0), MFA, RBAC/ABAC, privileged access management, cloud-native IAM (AWS IAM, GCP IAM, Azure RBAC), and DoD PKI/CAC authentication.
• Extensive hands-on experience architecting and securing AWS, Azure, and/or GCP environments including VPC/VNet design, cloud IAM and account structure, encryption and key management (KMS/HSM), logging and monitoring, native security services (GuardDuty, Security Hub, Defender for Cloud), GovCloud, and cloud-native patterns (containers, Kubernetes, CI/CD).
• Demonstrated ability to produce clear, accurate architecture, authorization boundary, and data-flow diagrams suitable for authorization packages and assessor review using tools such as Lucidchart, draw.io, or Visio.
• Strong working knowledge of NIST 800-37 (RMF) and NIST 800-53 (Rev 4/5) with ability to translate technical designs into control implementations, SSP content, and RMF workflows in eMASS or similar GRC tools.
• Familiarity with DISA PPSM, CAL, DISA Cloud Computing SRG, STIGs, DoD ICAM policy, and DoD Zero Trust Reference Architecture.
• Active U.S. Secret security clearance required; DoD 8570/8140 IASAE Level II baseline certification (CISSP, CASP+, CSSLP) required or obtainable within 90 days; at least one professional-level cloud certification (AWS Certified Security – Specialty, AZ-500, Google Professional Cloud Security Engineer) required or obtainable within 6 months.
• Ability to explain complex technical designs to engineers, architects, compliance staff, and government stakeholders and produce concise, assessor-ready documentation.
• U.S. citizenship is required for this role.

⭐ Desirable Experience

Success at 2F Looks Like:
A proactive and solutions oriented mindset
Viewing obstacles as opportunities for growth
Having a bias towards action

🎁 Benefits

The base salary for this position will fall between $200,000-$210,000. Your ultimate compensation will be determined by professional background, technical proficiency, seniority, and regional cost factors. Furthermore, this opportunity includes potential eligibility for equity awards and discretionary bonuses, rounding out a comprehensive total rewards offering.

🛂 Visa & Eligibility

Candidates must reside in one of our approved hiring hubs:
• DC/Maryland/Virginia
• Denver/Colorado Springs, CO

U.S. citizenship is required for this role.