Information Systems Security Engineer

Second Front Systems is looking for a technically deep, mission-focused, security-first Information Systems Security Engineer to strengthen our cybersecurity and solutions architecture practice.

Operating at the boundary between engineering delivery and DoD authorization, you will be responsible for owning the security architecture and compliance engineering view of 2F's Game Warden platform and customer applications it hosts.

You will work side by side with Solutions Architects and customers to design secure-by-design solutions and translate engineering decisions into RMF artifacts, control narratives, and authorization evidence, ensuring that solutions are defensible under DoD RMF and hold up to assessor and Authorizing Official review.

We need someone capable of designing and validating identity and access management flows (federation, SAML, OIDC/OAuth 2.0, cloud IAM, DoD PKI/CAC, privileged access) aligned with DoD ICAM and Zero Trust; producing clear authorization boundary diagrams, network architecture diagrams, and data-flow diagrams that trace CUI and sensitive data end to end; and translating technical architectures into NIST 800-53 control implementations, SSP sections, PPSM registrations, and significant change impact analyses.

As a key partner to ISSMs, ISSOs, assessors, Authorizing Officials, and engineering teams, you will serve as the technical subject matter expert during assessments, readiness reviews, and audits, and advance secure-by-design and compliance-as-code practices across cloud-native environments, serving as the bridge between architecture decisions and authorization boundaries.

Note: Candidates must reside in one of our approved hiring hubs:
• DC/Maryland/Virginia
• Denver/Colorado Springs, CO

This is a full-time position.

What You'll Do
• Architect identity and access management designs covering federation, MFA, RBAC/ABAC, privileged access, and DoD PKI/CAC authentication across AWS, Azure, and GCP.
• Build and maintain authorization boundary diagrams, network architecture diagrams, and data-flow diagrams showing components, trust boundaries, ports, protocols, and movement of CUI and sensitive data.
• Translate engineering and architecture decisions into RMF artifacts including SSP architecture sections, AC/IA/SC/AU control narratives, PPSM registrations, and significant change impact analyses.
• Evaluate proposed designs and new services against NIST 800-53, DISA Cloud Computing SRG, STIGs, and FedRAMP requirements and recommend compliant alternatives.
• Govern security and authorization impact of architecture changes, customer integrations, and new services, advising ISSMs and ISSOs on significance and re-authorization requirements.
• Synchronize with Solutions Architects and customer architects during onboarding, design, and change activities to embed security and authorization requirements from first conversation.
• Establish Zero Trust principles, infrastructure-as-code guardrails, and compliance-as-code practices to enforce and evidence security controls automatically in cloud-native environments.
• Own the technical subject matter expert role during assessments, readiness reviews, and audits, walking SCAs and Authorizing Officials through architecture and identity design.

What You Bring
• 5–8 years of hands-on security engineering, cloud security architecture, or information assurance; minimum 4 years designing and securing production workloads in AWS, Azure, or GCP; minimum 3 years supporting DoD or federal authorizations under RMF.
• Expert fluency in identity and access management: SSO and federation (SAML, OIDC/OAuth 2.0), MFA, RBAC/ABAC, privileged access management, cloud-native IAM (AWS IAM, GCP IAM, Azure RBAC), and DoD PKI/CAC authentication.
• Extensive hands-on experience architecting and securing AWS, Azure, and/or GCP environments including VPC/VNet design, cloud IAM and account structure, encryption and key management (KMS/HSM), logging and monitoring, native security services (GuardDuty, Security Hub, Defender for Cloud), GovCloud, and cloud-native patterns (containers, Kubernetes, CI/CD).
• Demonstrated ability to produce clear, accurate architecture, authorization boundary, and data-flow diagrams suitable for authorization packages and assessor review using tools such as Lucidchart, draw.io, or Visio.
• Strong working knowledge of NIST 800-37 (RMF) and NIST 800-53 (Rev 4/5) with ability to translate technical designs into control implementations, SSP content, and RMF workflows in eMASS or similar GRC tools.
• Familiarity with DISA PPSM, CAL, DISA Cloud Computing SRG, STIGs, DoD ICAM policy, and DoD Zero Trust Reference Architecture.
• Active U.S. Secret security clearance required; DoD 8570/8140 IASAE Level II baseline certification (CISSP, CASP+, CSSLP) required or obtainable within 90 days; at least one professional-level cloud certification (AWS Certified Security – Specialty, AZ-500, Google Professional Cloud Security Engineer) required or obtainable within 6 months.
• Ability to explain complex technical designs to engineers, architects, compliance staff, and government stakeholders and produce concise, assessor-ready documentation.
• U.S. citizenship is required for this role.

Preferred

The base salary for this position will fall between $200,000-$210,000. Your ultimate compensation will be determined by professional background, technical proficiency, seniority, and regional cost factors. Furthermore, this opportunity includes potential eligibility for equity awards and discretionary bonuses, rounding out a comprehensive total rewards offering.

Success at 2F Looks Like:
• A proactive and solutions oriented mindset
• Viewing obstacles as opportunities for growth
• Having a bias toward action and tangible, measurable results
• Being team-oriented with a focus on personal responsibility and autonomy

Perks & Benefits:
This role is a full time position. As a public benefit corporation, we’re a team of purpose-driven trailblazers transforming the future of U.S. national security. We hire the best to do their best and, as such, we are committed to providing the perks and benefits you need to be successful—both in- and outside the workplace.

Perks of Joining Our Team:
• Competitive salary
• 100% employer-paid medical, dental, and vision coverage for you and your dependents
• 401(k) with a 3% company contribution
• Comprehensive wellness benefits, including a One Medical membership, mental health resources, family planning support, and more
• Equity incentive plan
• New hire technology and home office stipend
• Annual professional development stipend
• Flexible paid time off, plus all federal holidays
• Generous parental leave
• Flexible remote work opportunities
• Employee referral bonus program
Visit our careers page to learn more.

Who We Are:
Second Front Systems (2F) is a public-benefit software company powering software for the free world. We eliminate the friction that slows innovation, enabling faster, more secure development and deployment of software across government and regulated networks. Built by national security veterans and backed by top-tier venture capital, our platform is trusted by the world’s leading organizations to cut deployment timelines from years to weeks. We move fast, solve hard problems, and deliver trusted capabilities where they’re needed most. Our work strengthens global security and gives the United States and its allies a lasting competitive advantage. Learn more at secondfront.com.

Citizenship requirement:
This position requires U.S. citizenship due to the nature of our work supporting U.S. government and defense customers.

One last thing:
We are an equal opportunity employer and all qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity or expression, pregnancy, age, national origin, disability status, genetic information, protected veteran status, or any other characteristic protected by law.

Are you ready to join our team:
To apply, click the “Apply for This Job” button at the top or bottom of this page and complete the application form. This position will remain open until filled, and applications will be reviewed on a rolling basis.

State notices:
Colorado:
In accordance with Colorado law, applicants may redact their date of birth, dates of attendance, and dates of graduation from any uploaded documents.
Maryland:
Under Maryland law, an employer may not require or demand, as a condition of employment, prospective employment, or continued employment, that an individual submit to or take a polygraph examination or similar test. An employer who violates this law is guilty of a misdemeanor and subject to a fine not exceeding $100.