Information Systems Security Engineer

Zachary Piper Solutions is seeking an Information Systems Security Engineer (ISSE) to support a federal and DOD cybersecurity mission. The ISSE will support the secure design, engineering, implementation, and authorization of cloud-native systems across production cloud environments and classified federal infrastructure. This position focuses on hands-on cloud security engineering, security architecture, IAM, cloud workload protection, and integration of security controls into DevSecOps and CI/CD environments. The ISSE will work closely with ISSMs, ISSOs, software developers, cloud engineers, system architects, and government stakeholders to engineer secure cloud architectures, implement technical security controls, and support RMF authorization activities. The ideal candidate has hands-on experience securing production cloud workloads, strong AWS security and architecture expertise, demonstrated IAM engineering capabilities, and experience translating cloud security architecture into DoD authorization artifacts and security compliance requirements.

Responsibilities of the ISSE include:

• Design, implement, and maintain secure cloud architectures supporting production workloads across AWS, Azure, or GCP environments, with a strong preference for AWS and AWS GovCloud
• Engineer and implement technical security controls across cloud infrastructure, applications, identities, networks, and workloads
• Develop and maintain cloud security architecture patterns encompassing VPC/VNet design, account structures, network segmentation, authorization boundaries, encryption, logging, monitoring, and security controls
• Design, implement, and maintain IAM solutions, including SSO, federation, SAML, OIDC, OAuth2, MFA, RBAC, ABAC, PAM, and least-privilege access controls
• Secure cloud workloads through appropriate access controls, encryption, security monitoring, vulnerability management, and workload protection mechanisms
• Implement and maintain cloud security monitoring and detection capabilities using AWS GuardDuty, Security Hub, CloudTrail, Azure Defender, or equivalent cloud-native security technologies
• Integrate security into cloud-native applications, containers, Kubernetes environments, and CI/CD pipelines
• Implement and maintain cloud security guardrails, IaC, automation, and compliance-as-code practices to enforce security requirements across cloud environments
• Support the secure design, implementation, and operation of AWS GovCloud workloads supporting DoD IL4, IL5, and IL6 environments
• Develop, review, and maintain security architecture diagrams, authorization boundary diagrams, network diagrams, data-flow diagrams, trust boundaries, and PPS documentation
• Translate cloud architecture and engineering decisions into security control implementation requirements, SSP documentation, security control narratives, and authorization artifacts
• Support DoD RMF authorization activities in accordance with NIST SP 800-37 and NIST SP 800-53, including control implementation, assessment preparation, authorization documentation, and ongoing authorization
• Support SIAs, significant change reviews, authorization boundary updates, and security engineering reviews associated with cloud infrastructure and application modifications
• Implement and validate technical security controls supporting DISA Cloud SRG, STIGs, FedRAMP, and applicable DoD cybersecurity requirements
• Support vulnerability assessments, security testing, remediation, and continuous monitoring across cloud infrastructure, applications, containers, and workloads
• Collaborate with ISSOs, ISSMs, SCAs, system owners, cloud engineers, developers, and Authorizing Officials to resolve security findings and maintain authorization compliance
• Provide technical security guidance to engineering teams throughout system design, development, deployment, integration, and operational sustainment
• Participate in technical architecture reviews, security assessments, engineering discussions, and government authorization briefings
• Support cloud security modernization, Zero Trust architecture, DoD ICAM, and secure cloud migration initiatives

Qualifications of the ISSE include:

• 5-8+ years of experience in cybersecurity, information security engineering, cloud security architecture, or security engineering supporting federal or commercial environments
• At least 4 years of hands-on experience securing production cloud workloads across AWS, Azure, or GCP environments
• At least 3 years of experience supporting DoD or federal RMF authorization processes, ATO packages, security control implementation, and authorization documentation
• Demonstrated hands-on cloud security engineering and architecture experience beyond security compliance, control assessments, or documentation alone
• Strong experience designing, implementing, and securing cloud infrastructure, including VPC/VNet architecture, network segmentation, encryption, key management, logging, monitoring, and cloud security boundaries
• Hands-on experience with cloud identity and access management, including IAM, SSO/federation, SAML, OIDC, OAuth2, MFA, RBAC/ABAC, PAM, or equivalent identity security technologies
• Experience securing production cloud applications, workloads, infrastructure, and cloud-native services
• Experience implementing or integrating cloud security monitoring, vulnerability management, and workload protection capabilities
• Experience translating cloud security architecture into security controls, authorization documentation, security diagrams, and RMF artifacts
• Strong knowledge of NIST SP 800-37, NIST SP 800-53, DoD RMF, and applicable federal cybersecurity requirements
• Experience supporting cloud security architecture, security engineering, control implementation, and authorization activities throughout the system lifecycle
• Active Secret Clearance
• Active IASAE Level II certification (or ability to obtain within 90 days)
• Professional cloud security certification, such as AWS Security Specialty, AZ-500, Google Professional Cloud Security Engineer, or equivalent, or ability to obtain within 6 months

Preferred Qualifications of the ISSE include:

• Experience designing, implementing, and securing AWS GovCloud environments supporting DoD IL4, IL5, or IL6 workloads
• Experience with AWS security services including GuardDuty, Security Hub, CloudTrail, IAM, KMS, AWS Config, and related cloud-native security capabilities
• Experience with AWS multi-account architecture, VPC design, security groups, network segmentation, and cloud security boundary implementation
• Experience with AWS IAM architecture, federation, SAML, OIDC, OAuth2, MFA, privileged access management, and DoD ICAM/PKI/CAC integration
• Experience with Kubernetes, Docker, OpenShift, container security, orchestration, and cloud-native application architectures
• Experience integrating security into CI/CD pipelines, DevSecOps workflows, and automated software delivery environments
• Experience with infrastructure-as-code technologies such as Terraform, CloudFormation, AWS CDK, or equivalent
• Experience with compliance-as-code, automated security validation, security guardrails, and continuous compliance tooling
• Experience implementing Zero Trust security architectures and cloud identity security controls
• Experience with DISA Cloud SRG, STIGs, FedRAMP, and cloud authorization boundaries
• Experience with eMASS, Xacta, RegScale, CSAM, or other GRC/RMF authorization platforms
• Experience developing security architecture diagrams, authorization boundary diagrams, network diagrams, and data-flow diagrams using Visio, Lucidchart, draw.io, or similar tools
• Experience supporting Security Control Assessors, Security Control Assessments, ST&E, and technical security validation
• Experience supporting SIAs, significant change reviews, authorization boundary updates, and cloud security assessments
• Experience securing production cloud workloads, microservices, containers, and distributed application architectures
• Experience with cloud vulnerability management, penetration testing, security testing, and remediation coordination
• Experience supporting cybersecurity modernization, cloud migration, and secure system lifecycle activities
• Strong technical documentation, analytical, communication, and problem-solving skills
• Ability to collaborate across cybersecurity, cloud engineering, software development, DevSecOps, and government teams

Compensation for the ISSE includes:

• Salary Range: $200,000-210,000 **depending on experience**
• Benefits including an a nnual bonus (10%), equity opportunities me dical benefits (100% employer-paid), unlimited PTO, paid federal holidays, home-office stipend, and more

Keywords: Information Systems Security Engineer, ISSE, Cloud Security Engineer, Cloud Security Architect, Security Engineer, Cybersecurity Engineer, Information Security Engineering, Cloud Security Architecture, DoD Cybersecurity, Federal Cybersecurity, RMF, Risk Management Framework, NIST RMF, NIST SP 800-37, NIST 800-37, NIST SP 800-53, NIST 800-53 Rev 5, Security Engineering, Security Architecture, Cloud Security Engineering, Cloud Infrastructure Security, Production Cloud Workloads, AWS, Amazon Web Services, AWS GovCloud, GovCloud, Azure, Microsoft Azure, GCP, Google Cloud Platform, Cloud Security Architecture, Cloud Workload Security, Cloud Infrastructure, Cloud-Native Security, Cloud Security Controls, Cloud Security Monitoring, Cloud Security Posture Management, CSPM, Cloud Security Compliance, Cloud Authorization, Cloud Security Boundaries, Authorization Boundary, Security Boundary, Network Architecture, Network Security, VPC, Virtual Private Cloud, VNet, Network Segmentation, Security Groups, Network ACLs, Routing, Cloud Networking, Multi-Account Architecture, AWS Organizations, IAM, Identity and Access Management, AWS IAM, Azure IAM, Cloud IAM, ICAM, DoD ICAM, Identity Security, SSO, Single Sign-On, Federation, SAML, OIDC, OAuth2, MFA, Multi-Factor Authentication, RBAC, Role-Based Access Control, ABAC, Attribute-Based Access Control, PAM, Privileged Access Management, Least Privilege, Zero Trust, Zero Trust Architecture, DoD Zero Trust, PKI, DoD PKI, CAC, Certificate-Based Authentication, Encryption, KMS, Key Management, HSM, Encryption at Rest, Encryption in Transit, CloudTrail, GuardDuty, Security Hub, AWS Config, CloudWatch, Azure Defender, Security Monitoring, Threat Detection, Vulnerability Management, Cloud Vulnerability Management, Container Security, Containers, Docker, Kubernetes, OpenShift, Microservices, Cloud-Native Applications, Workload Protection, DevSecOps, CI/CD, Continuous Integration, Continuous Delivery, Secure Software Development Lifecycle, SSDLC, Application Security, SAST, DAST, Software Composition Analysis, Infrastructure as Code, IaC, Terraform, CloudFormation, AWS CDK, Compliance as Code, Security Automation, Automated Security Validation, Security Guardrails, Continuous Compliance, RMF Authorization, ATO, Authorization to Operate, ATO Packages, ATO Sustainment, Ongoing Authorization, Continuous Monitoring, ConMon, eMASS, Xacta, RegScale, CSAM, ServiceNow GRC, System Security Plan, SSP, Security Control Narratives, Security Control Implementation, Security Control Assessment, Security Assessment, Security Impact Analysis, SIA, Significant Change Review, Ports Protocols and Services, PPSM, Data Flow Diagrams, Network Diagrams, Security Architecture Diagrams, Trust Boundaries, Security Documentation, Authorization Documentation, Security Control Mapping, Security Evidence, POA&M, POAM, Vulnerability Remediation, ACAS, Tenable Nessus, STIG, DISA STIG, DISA Cloud SRG, Cloud Security Requirements Guide, FedRAMP, DoD RMF, Department of Defense, Federal Information Systems, Classified Systems, Secret Clearance, Active Secret, Fully Adjudicated Secret, TS/SCI, DoD 8570, DoD 8140, IASAE Level II, CISSP, CASP+, CSSLP, AWS Security Specialty, AZ-500, Google Professional Cloud Security Engineer, Cloud Security Certification, Security Engineer, Cloud Engineer, Cloud Architect, Security Consultant, Information Assurance, IA, Cybersecurity Risk, Security Posture, Security Compliance, Security Testing, ST&E, Security Validation, Security Control Assessor, SCA, ISSM, Information System Security Manager, ISSO, Information System Security Officer, System Owner, Cloud Engineer, Software Developer, DevOps Engineer, Government Stakeholders, AO, Authorizing Official, Federal Cybersecurity, Defense Cybersecurity, Mission Assurance, Cybersecurity Modernization, Cloud Migration, Cloud Engineering, Secure Cloud Architecture, DC, Washington DC, Maryland, Virginia, Denver, Colorado Springs

#LI-SW1

#LI-REMOTE