{"id":2570655,"url":"https://alion.io/job/pueo-senior-cybersecurity-engineer","title":"Senior Cybersecurity Engineer","company":{"id":2598495,"name":"Pueo","domain":"pueo.com","url":"https://alion.io/company/pueo","size_band":"501-1000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Paylocity","truth_index":{"grade":"B","score":75,"open_postings":4,"ghost_share":0,"stale_share":1,"repost_share":0,"time_to_fill_p50_days":null,"computed_at":"2026-10-15T05:46:00Z"}},"role":"Security","role_family":"Security","seniority":"senior","employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["McLean, United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":119000,"max_usd":232000,"period":"year","method":"role_seniority_country_remote_cell","sample_n":1245},"experience_years_min":12,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Blue-Green Deployment","optional":false},{"name":"CI/CD","optional":false},{"name":"Cosign","optional":false},{"name":"CVE","optional":false},{"name":"Docker","optional":false},{"name":"Falco","optional":false},{"name":"FedRAMP","optional":false},{"name":"GitLab","optional":false},{"name":"Grafana","optional":false},{"name":"Grype","optional":false},{"name":"IAM","optional":false},{"name":"Jenkins","optional":false},{"name":"kube-bench","optional":false},{"name":"kube-hunter","optional":false},{"name":"Kubernetes","optional":false},{"name":"Kyverno","optional":false},{"name":"NIST 800-53","optional":false},{"name":"OPA Gatekeeper","optional":false},{"name":"OpenShift","optional":false},{"name":"PKI","optional":false},{"name":"Prometheus","optional":false},{"name":"Service Mesh","optional":false},{"name":"Sigstore","optional":false},{"name":"Syft","optional":false},{"name":"Trivy","optional":false},{"name":"Zero Trust","optional":false},{"name":"Open Policy Agent","optional":true}],"status":"live","first_seen_at":"2026-03-17T21:01:54Z","employer_posted_date":"2026-10-14","last_verified_at":"2026-10-15T17:40:07Z","board_verified":true,"closed_at":null,"days_open":211,"trust":{"level":"stale","repost_count":0,"flags":["stale"],"days_open":211},"description":"Description\nPueo is known for bringing the best talent and unique tools to every opportunity. Pueo's Parliament (aka workforce) is composed of professionals who are seeking the opportunity to work in a business organization that thrives on career development and independence. In support of mission and professional growth, our Parliament has supported the development of multiple patents, proprietary tools, and applications as well as trademarked processes.\nOur organization emphasizes career development across multiple career environments (at the members own pace) and ensures those who contribute broadly are properly rewarded. Pueo has four career environments where every member of the parliament can participate. Each environment has opportunities available for all levels. Opportunities are framed by an employee's desires and capabilities, and we ensure challenges, growth, and unique experiences are available for employees at all levels.\nOur Career Environments (Program, Functional, Service, and Leadership) provide numerous opportunities for employees to invest in their personal growth and those things that offer fulfillment. We invest in helping our members create and execute their career development plans. Our Pods (small teams of 5 or less) are comprised of personnel with similar skillsets to ensure mentorship, understanding, and peer support.\nOVERVIEW:\nWe are seeking a highly skilled Cybersecurity Engineer (CSE) with extensive experience in air-gapped and classified container platforms, CI/CD pipelines, security automation, and federal cybersecurity requirements. The ideal candidate will possess hands-on expertise in Kubernetes, OpenShift, registry management, security test automation, and the implementation of cybersecurity controls in compliance with federal standards like NIST 800-53, DISA STIGs, and RMF/ATO workflows.\nA) Air-Gapped / Classified Container Platforms (Kubernetes/OpenShift/RKE2)\n Designing a Disconnected Cluster Design and manage a multi-container OpenShift hosted platform in an air-gapped enclave.\n Expertise in cross-domain CI/CD, blue-green testing, and platform deployment within disconnected environments.\n Familiar with image/helm/chart mirroring, FIPS 140 validated crypto, OS hardening (e.g., Alpine), and SELinux enforcing.\n\nRegistry and Artifact Governance Maintain and govern a disconnected container registry, ensuring content sources, image signing, SBOMs, and vulnerability gating.\n Familiarity with tools such as Cosign, Syft, Grype, Trivy, OCI level attestations, and curated repository promotions.\n\nAdmission Control & Policy Enforcement Enforce security baselines and policies without internet dependencies using tools like OPA Gatekeeper, Kyverno, and image provenance verification.\n\n Cluster Multi-Tenancy in SCIFs Implement RBAC, namespace isolation, and mTLS for mixed-sensitivity workloads within a SCIF (Sensitive Compartmented Information Facility).\n\nPatching and CVE Response Offline Manage critical Kubernetes CVEs in air-gapped enclaves through risk triage, change windows, and mirrored updates.\n\nB) CI/CD & Security Test Automation (Disconnected)\nPipeline Architecture for Classified Enclaves Design CI/CD pipelines to build, test, sign, scan, and promote containers across Dev ? Test ? Prod in closed networks.\n Familiarity with GitLab/Jenkins runners, artifact promotion, and “compliance as code” practices.\n\nAutomated Security Testing Coverage Implement automated tests for SAST, DAST, IAST, SCA, and IaC scanning within CI/CD pipelines.\n Ensure pipeline failures persist if discrepancies are detected.\n\nEvidence Generation for RMF Generate RMF/ATO evidence via automated pipeline outputs, mapping artifacts to NIST controls.\n Knowledge of OSCAL output, control mappings, and integration with evidence stores like eMASS.\n\n Promotion Gates & Provenance Ensure artifacts meet quality and security criteria (e.g., reproducible builds, signed/provenanced artifacts, passing STIG checks) before promotion to higher environments.\n\nTesting for Platform + App Security Regressions\nImplement tests for platform upgrade regressions using tools like kube-bench, kube-hunter, and e2e integration suites.\nC) Federal Cybersecurity Requirements (RMF/ATO, STIGs, CNSS, FedRAMP)\nRMF Tailoring in Containerized Systems\nTailor NIST 800-53 controls for microservices platforms, identifying platform vs. app team responsibilities.\nWork with shared responsibility matrices and control inheritance catalogs.\nDISA STIG Application to Kubernetes Workloads\nApply and track Kubernetes/Docker/OpenShift STIG findings and exceptions.\nImplement a \"STIG as code\" approach in CI/CD pipelines and perform continuous drift checks.\n Continuous Monitoring (CONMON)\nImplement telemetry collection for CONMON using on-prem tools (e.g., Prometheus, Grafana, auditd, Falco).\nDesign and manage control dashboards and evidence snapshots.\nATO Acceleration through Automation\nReduce ATO lead times using automated assessments, OSCAL generation, and integration with tools like eMASS.\nPolicy Conflicts & Adjudication\nReconcile conflicts between NIST, CNSS, and program-specific directives, leveraging risk-based decision memos and compensating controls.\nD) Networking, Identity & Zero Trust in On-Prem/Classified Enclaves\nZero Trust in Kubernetes\nImplement Zero Trust principles within Kubernetes beyond mTLS and RBAC, using tools like SPIFFE, SPIRE, and service mesh authZ.\nOffline PKI Operations\nManage certificate lifecycles in air-gapped environments, utilizing offline roots, short-lived certs, and mesh cert synchronization strategies.\nEast-West Segmentation Strategy\nDesign and implement micro-segmentation and egress controls for multi-tenancy within classified environments.\nIdentity Propagation Across Layers\nEnsure identity propagation from build systems through runtime enforcement, using tools like Sigstore attestations and audit chain linking.\nCross-Domain and Data Movement Patterns\nSecurely move artifacts across domains with tamper-evident transfer logs, hash-based validation, and offline review stations.\nE) Operations, SRE & Incident Response in SCIFs\nObservability without SaaS\nBuild observability solutions for logs, metrics, traces, and capacity planning using on-prem tools like EFK, Prometheus, and Tempo.\nBreak Glass & Change Control\nDesign a break-glass process with time-bound privilege elevation, session recording, and immutable logs.\nForensics & Container Runtime\nCollect forensic evidence from compromised container nodes while preserving data integrity through disk snapshots and isolated triage nodes.\nResiliency & DR in Disconnected Sites\nDevelop strategies for service continuity across multiple isolated sites, including staged upgrades and backup/restore drills.\nApplication Team & SOC Integration\nIntegrate containerized environments with enterprise SOC teams during incident detection, containment, and recovery.\nDefine roles, telemetry requirements, and communication channels for effective response.\nREQUIRED QUALIFICATIONS:\n12 years of experience and a Masters degree. Degree can be substituted for 6 additional years of applicable experience\nIAT/IAM Level 3 Certification in compliance with DoD 8570/8140 guidelines\nExtensive experience working with Kubernetes, OpenShift, RKE2, and container registry management in air-gapped and classified environments.\nDeep understanding of CI/CD pipeline architectures, especially in disconnected networks.\nExpertise in federal cybersecurity frameworks, such as NIST 800-53, DISA STIGs, RMF, and ATO processes.\nFamiliarity with security testing tools (SAST, DAST, IAST, IaC) and automated compliance validation.\nProven track record of enforcing Zero Trust principles, PKI management, and network segmentation in a classified environment.\nStrong ability to map pipeline artifacts to RMF/ATO controls and support security operations during incidents.\nExtensive experience in cybersecurity design and architecture.\nCLEARANCE:\nTop Secret minimum\nPueo is an equal employment opportunity employer and affirmative action employer. All interested individuals will receive consideration and will not be discriminated against on the basis of race, color, religion, sex, national origin, disability, age, sexual orientation, gender identity, genetic information, or protected veteran status. Pueo takes affirmative action in support of its policy to advance diversity and inclusion of individuals who are minorities, women, protected veterans, and individuals with disabilities.","description_format":"text","description_chars":8491,"description_truncated":false,"requirements":{"experience_years_min":12,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"master","optional":false},"security_clearance":true,"languages":[]},"benefits":[],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Cybersecurity","Information Security","National Security","Application Security"],"lifecycle":[{"event":"open","at":"2026-10-14T22:52:43Z"}],"visa":[],"liveness":{"score":8,"band":"cold","label":"Long shot","p_open":1,"p_active":0.291,"p_room":0.28,"age_days":211,"expected_fill_days":38,"reasons":["conf:2","win:tail","crowd:"],"computed_at":"2026-10-15T05:46:00Z"},"pay":null,"html_url":"https://alion.io/job/pueo-senior-cybersecurity-engineer","json_url":"https://alion.io/job/pueo-senior-cybersecurity-engineer.json","meta":{"generated_at":"2026-10-15T19:25:17Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":29356,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-16T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":2598495},"rest":"https://alion.io/mcp/rest/get_company?id=2598495"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fpueo-senior-cybersecurity-engineer"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fpueo-senior-cybersecurity-engineer"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fpueo-senior-cybersecurity-engineer"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/pueo-senior-cybersecurity-engineer\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fpueo-senior-cybersecurity-engineer"}]}