{"id":3394621,"url":"https://alion.io/job/istari-digital-sr-security-engineer","title":"Sr. Security Engineer","company":{"id":2405842,"name":"Istari Digital","domain":"istaridigital.com","url":"https://alion.io/company/istaridigital","size_band":"11-50","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":null,"truth_index":null},"role":"Security","role_family":"Security","seniority":"senior","employment_type":"full_time","work_mode":"remote","remote_scope":"stated_countries","remote_scope_basis":"board_field","remote_working_hours":null,"hiring_geo_confidence":"inferred","locations":[],"countries":[],"hiring_countries":["US"],"hiring_countries_total":1,"salary":{"min":135000,"max":220000,"currency":"USD","period":"year","gross":null,"usd_annual":220000},"salary_estimate":null,"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"CI/CD","optional":false},{"name":"Incident Management","optional":false},{"name":"pre-commit","optional":false},{"name":"Python","optional":false},{"name":"Shift-Left Security","optional":false},{"name":"ArgoCD","optional":true},{"name":"AWS","optional":true},{"name":"Docker","optional":true},{"name":"GitHub","optional":true},{"name":"Kubernetes","optional":true},{"name":"Kyverno","optional":true},{"name":"LLM","optional":true},{"name":"Open Policy Agent","optional":true},{"name":"Snyk","optional":true}],"status":"live","first_seen_at":"2026-10-28T08:58:40Z","employer_posted_date":null,"last_verified_at":"2026-10-28T08:58:40Z","board_verified":false,"closed_at":null,"days_open":1,"trust":{"level":"not_scored","repost_count":null,"flags":[],"days_open":1},"description":"We are seeking a Senior Security Engineer to lead and advance the security tooling that tests and validates our software against compliance and cybersecurity standards. In this role, you will ensure our toolchain is consistently enforced, highly trustworthy, and continuously enhanced as our products, customer base, and regulatory requirements expand. You will also be a key early contributor as we design and implement our application security and security operations functions. \n\nYou will be the technical authority for how security checks are configured, tuned, and enforced across our software development lifecycle (SDLC). You will translate compliance and Risk Management Framework (RMF) requirements into automated, risk-based controls that give engineers fast, actionable feedback early in development. Your expertise in AI-based automation will be key to success. The goal is a pipeline calibrated to the speed of organizational need: secure by default, automated wherever possible, and supported by clear human review when automation flags risk.\n\nOn the other end of the SDLC, you will help implement automated and manual pen-testing and other security-related testing capabilities across a range of deployment environments. You will help develop our security operations capabilities with faster and more automated incident response and incident management. Applying an AI-first approach to these functions will enable faster, more efficient, higher-quality outcomes. \n\nThis role supports regulated and security-sensitive environments, including systems hosted for Government customers, and partners closely with engineering, product, and cybersecurity leadership.\n\nCore Responsibilities\nOwn and evolve the security toolchain\nServe as the technical owner of our pipeline security tooling, including static application security testing (SAST), software composition analysis (SCA), secrets detection, container scanning, and artifact signing\n\nAssess tooling effectiveness and coverage, identify gaps, and recommend and lead improvements, consolidation, or replacement as needs evolve\n\nDevelop automated and manual pen-testing capabilities with rapid feedback loops into the engineering process.\n\nHelp mature the security operations and incident response capabilities of the company.\n\nDefine the long-term roadmap for security tooling and processes in partnership with Cybersecurity and Engineering leadership\n\nTune controls to compliance requirements\nTranslate National Institute of Standards and Technology (NIST) SP 800-53, NIST SP 800-171, and RMF control requirements into enforceable pipeline gates, thresholds, and policies\n\nEvolve and maintain risk-based pass/fail criteria that balance security assurance with delivery speed and minimize false positives\n\nEnsure tooling outputs produce assessor-ready evidence that supports authorizations, continuous monitoring, and audits\n\nOwn the exception and manual-review process for findings that fail automated checks, so decisions are documented and traceable\n\nEnforce integrity and consistency\nEnsure security results cannot be bypassed or tampered with, including enforcement of artifact signing, signature verification before deployment, commit signing, branch protection, and repository rulesets\n\nAutomate the creation and maintenance of software bills of materials (SBOMs) and vulnerability exploitability exchange (VEX) data for delivered software\n\nDrive shift-left adoption\nMove security checks to the earliest practical point (developer workstation, pre-commit, pull request, etc.)\n\nPartner with engineering teams to embed security into their workflows, supported by clear standards and guidance, so the secure path is the easy path\n\nApply artificial intelligence (AI) tooling to accelerate vulnerability triage, remediation, and security automation, and evaluate emerging AI capabilities for the toolchain\n\nRequired Qualifications\n7+ years in DevSecOps, application security, security operations and incident response, and general security engineering, including at least 3 years owning security tooling in continuous integration and continuous delivery (CI/CD) pipelines\n\nDeep hands-on experience configuring, tuning, and enforcing SAST, SCA, secrets detection, and container scanning tools in production pipelines, including risk-based gates, vulnerability thresholds, and exception processes\n\nDemonstrated experience mapping security tooling and pipeline controls to NIST SP 800-53, NIST SP 800-171, or RMF requirements, and producing evidence for assessments or authorizations\n\nTrack record of evaluating, selecting, or evolving security tooling, and influencing engineering teams without direct authority\n\nScripting or automation experience in Python, Bash, or similar\n\nSecurity+ or equivalent Department of Defense (DoD) 8140 qualifying certification, or ability to obtain within 2 months of hire\n\nU.S. citizen residing and working in the U.S.\n\nPreferred Qualifications\nFamiliarity with tools such as GitHub, Argo CD, JFrog, and Snyk\n\nExperience in DoD software factory or Government DevSecOps environments (for example, Platform One, Iron Bank, or Big Bang)\n\nExperience supporting Authorization to Operate (ATO) efforts, including control assessment and Plan of Action and Milestones (POA&M) management\n\nExperience with software supply chain integrity and policy-as-code practices, such as artifact signing, signature verification, SBOMs, Open Policy Agent (OPA), or Kyverno\n\nExperience applying AI and large language model (LLM) tools to security engineering, such as AI-assisted triage, code review, or remediation\n\nExperience with penetration testing tools, processes, strategies. \n\nFamiliarity with the cloud and container environments where pipelines run and are deployed (for example, Github, Docker, Kubernetes, and AWS)\n\nAdvanced certifications such as CISSP, SecurityX (CASP+), or GIAC (GSSP, GCSA, or similar)\n\nActive security clearance (Top Secret highly desired)\n\nAbout Istari Digital\n\nIstari is a digital engineering software company building open, scalable infrastructure for engineering data. Our platform lets customers simply and securely integrate engineering models across disciplines, organizations, and security levels — whether they're designing prototypes, performing virtual testing, or training AI and autonomy for complex systems.\n\nFocus is rewarded. Finish is remembered.\n\nFacts are friendly. Even when they are not fun.\n\nFellowship is fundamental. Make others successful.\n\nOriginally posted on Himalayas","description_format":"text","description_chars":6506,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":true,"languages":[]},"benefits":[],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Blockchain Infrastructure","Information Security","Application Security"],"lifecycle":[{"event":"open","at":"2026-10-28T11:28:00Z"}],"visa":[],"liveness":{"score":90,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.903,"p_room":1,"age_days":0,"expected_fill_days":7,"reasons":["seen:0","velocity","win:early"],"computed_at":"2026-10-29T05:49:05Z"},"pay":{"stated_usd_annual":220000,"is_top_pay":true},"html_url":"https://alion.io/job/istari-digital-sr-security-engineer","json_url":"https://alion.io/job/istari-digital-sr-security-engineer.json","meta":{"generated_at":"2026-10-29T18:14:14Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":26957,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-30T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":2405842},"rest":"https://alion.io/mcp/rest/get_company?id=2405842"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fistari-digital-sr-security-engineer"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fistari-digital-sr-security-engineer"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fistari-digital-sr-security-engineer"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/istari-digital-sr-security-engineer\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fistari-digital-sr-security-engineer"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":3394621}},{"tool":"search_jobs","arguments":{"company":"istaridigital.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":3394621},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}