Cybersecurity Engineer (COMDO12)
EMPLOYER IS A CONTRACTOR FOR THE U.S. GOVERNMENT. THIS POSITION WILL REQUIRE U.S. CITIZENSHIP.
Role Description:
As a cybersecurity engineer within Delivery at Defense Unicorns, you will own the full lifecycle of achieving and maintaining FedRAMP High authorization for mission-focused platforms and systems. This role requires hands-on experience supporting previous FedRAMP authorization packages. You will be expected to champion modern, continuous security implementations within DoW environments and systems (approval processes). Your perpetual goal will be to accelerate the FedRAMP and ATO process while simultaneously improving our security posture, thus pushing for cultural change away from security theater and towards responsive and resilient systems. While working within the existing FedRAMP processes, you will also work with other engineers to find the best paths forward toward the future with FedRAMP 20x implementation and contribute to Unicorn mission capabilities and open source solutions to further streamline ongoing and future efforts.
Responsibilities:
- Leading the effort to achieve FedRAMP authorization in accordance with Revision 5 requirements, while also working towards FedRAMP 20x implementation requirements
- Own the development and sustainment of authorization packages for U.S. Government compliance efforts, specifically FedRAMP High, DoD IL5 and IL6 requirements, continuous monitoring, and audit readiness.
- Collaborating with cross-functional teams including software developers, system architects, and other Government stakeholders to interpret and map compliance requirements to product implementation.
- Performing security testing and evaluation of our software platform to identify vulnerabilities and weaknesses (STIGs, ACAS, CI/CD security testing, etc.)
- Preparing and maintaining documentation required for the Authorization process, including System Security Plans (SSPs), Plan of Actions & Milestones (POA&M), Security Assessment Reports (SARs), and other relevant artifacts.
- Staying up-to-date with evolving cybersecurity threats, technologies, and regulations to proactively address security challenges and compliance frameworks..
- Building automation for manual process-driven compliance controls and supporting automated Compliance-as-Code capabilities that continuously evaluate the cybersecurity posture of the tech stack.
- Partner with technical teams to shape future product offerings and streamline engineering processes in support of scalable compliance, audit readiness, and authorization outcomes.
The listed responsibilities are not exhaustive and additional responsibilities may be assigned based on the evolving needs of the organization. We are seeking a dynamic individual who is able to adapt and take on new responsibilities as they arise.
Preferred Experience and Qualifications:
- Proven experience in cybersecurity engineering, with a focus on achieving authorization for software systems through FedRAMP with reuse within the DoD.
- Proven track record of thinking outside the box and pushing the boundaries of the RMF/FedRAMP/ATO status quo.
- In-depth knowledge of NIST-800 series standards, particularly NIST-800-53, and experience applying these standards to achieve accreditation.
- Skilled at translating technical implementation (infrastructure as code and configuration as code) into verifiable eMASS security control responses that Approving Officials (AOs), and their staffs, can understand.
- Strong understanding of cybersecurity principles, technologies, and best practices, including encryption, authentication, access control, and secure coding practices.
- Hands-on experience with security assessment tools and techniques, such as vulnerability scanning and security analysis.
- Familiarity with software development methodologies and practices, particularly Agile and DevSecOps.
- Excellent analytical and problem-solving skills, with the ability to assess complex systems and identify security risks.
- Effective communication and interpersonal skills, with the ability to collaborate with cross-functional teams and communicate technical concepts to non-technical stakeholders.
- Eligibility to obtain and maintain a DoD security clearance.
- Eligibility to obtain and maintain privileged access in a Government Cloud Environment (relevant training and/or certifications).
Desired Experience:
- Experience building and supporting platform authorizations for FedRamp High.
- Experience building and supporting continuous authority to operate (cATO) packages within the DoD
- Ability to use machine-readable schemas, such as OSCAL, to manage control implementations, control statements, and compliance evidence as Compliance-as-Code.
- Familiarity with the Cloud Computing Security Requirements Guide (CC SRG)
- Experience working in a remote team or asynchronous work environment where focus, discipline, and comfort navigating/leveraging various communication forms and frequencies to disseminate and prioritize information and keep stakeholders informed
Travel Expectations/Requirements: 10-15%, up to 3-4 times per year (quarterly)
Full compensation packages are based on candidate experience. Compensation ranges are established using national benchmarking data and apply across all geographic locations within the United States.
Remote - USA
$148,750—$201,250 USD
Who We Are
Defense Unicorns delivers mission value by streamlining software delivery so our customers can focus on the most important challenges. We share a vision of freedom and security for the advancement of progress and innovation. Our commitment to this vision, and to our mission-driven customers, means a commitment to speed, user experience and optionality, without compromising security. Our team is composed of innovators, software engineers, and veterans with decades of experience delivering technology programs across the federal market.
What We Do
We create and deliver secure solutions for continuous software integration and delivery. Defense Unicorns consolidates the best practices for security pipelines, testing, and deployment automation in order to meet the high security requirements valued by mission owners. Our solutions are agnostic by design and we believe that growing a robust ecosystem of secure, cloud-native software solutions can help enterprise customers inside and outside the federal market buy and integrate software more easily.
Who We Serve
Defense Unicorns’ customers are mission-focused leaders across public and private enterprises. We proudly support defense and civil agencies across the U.S. government and we work closely with the creators of leading-edge software solutions to deliver value to the mission-owner by improving the security and consumability of commercial software products.
What We Work On
- Kubernetes
- Cloud Environments (AWS/GCP and Azure)
- Infrastructure-as-code (like Terraform/Pulumi)
- Continuous Delivery and automation tooling
- GitOps
- Containers
- CNCF projects and open source products and packages
- Helm/Kustomize-Value Stream Mapping
- Building and improving security delivery
- Building Kubernetes and cloud native applications
Benefits Our Unicorns Enjoy
Health:
- Medical/Dental/Vision
- Premiums are 100% Company Paid
- Health Savings Account
- Life Insurance
- Disability Insurance
Financial:
- 401k Retirement Plan
- Company Stock Options
- Home Office Budget
Leave:
- We offer all full-time Unicorns Flexible Time Off (FTO) plus all Federal Holidays, one week for Thanksgiving, and two weeks for Christmas and New Year’s
- Paid Parental Leave
Learning:
- Reimbursement for approved trainings/subscriptions
- Conferences (travel, lodging, and fees)
Don’t have all the preferred experience or qualifications? Studies show that underrepresented groups like women and people of color are less likely to apply to jobs if they don't meet every requirement listed.
At Defense Unicorns, we're committed to diversity. If you're enthusiastic about the role but don't match every criteria, we encourage you to apply. You could be the perfect fit for this or another role! Defense Unicorns is an equal opportunity employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, disability, sex, sexual orientation, gender identity or expression, age, national origin, veteran status, genetic information, union status and/or beliefs, or any other characteristic protected by federal, state, or local law.