{"id":165490,"url":"https://alion.io/job/second-front-systems-cybersecurity-assessment-engineer","title":"Cybersecurity Assessment Engineer","company":{"id":58794,"name":"Second Front Systems","domain":"secondfront.com","url":"https://alion.io/company/second-front-systems","size_band":null,"is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Ashby","truth_index":null},"role":"Security","role_family":"Security","seniority":"senior","employment_type":"full_time","work_mode":"remote","remote_scope":"stated_countries","remote_scope_basis":"posting_text","remote_working_hours":null,"hiring_geo_confidence":"inferred","locations":[],"countries":[],"hiring_countries":["US"],"hiring_countries_total":1,"salary":{"min":155000,"max":175000,"currency":"USD","period":"year","gross":null,"usd_annual":175000},"salary_estimate":null,"experience_years_min":5,"visa_sponsorship":false,"relocation_package":false,"has_equity":true,"technologies":[{"name":"AWS","optional":false},{"name":"Azure","optional":false},{"name":"CI/CD","optional":false},{"name":"CIS Benchmarks","optional":false},{"name":"CVSS","optional":false},{"name":"Docker","optional":false},{"name":"EPSS","optional":false},{"name":"FedRAMP","optional":false},{"name":"GCP","optional":false},{"name":"GitLab","optional":false},{"name":"KEV","optional":false},{"name":"Kubernetes","optional":false},{"name":"OWASP Top 10","optional":false},{"name":"Platform Engineering","optional":false},{"name":"Terraform","optional":false},{"name":"Trivy","optional":false}],"status":"live","first_seen_at":"2026-07-17T19:58:02Z","employer_posted_date":"2026-07-17","last_verified_at":"2026-10-16T23:57:25Z","board_verified":true,"closed_at":null,"days_open":91,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":91},"description":"Cybersecurity Assessment Engineer\nSecond Front Systems (2F) is seeking a Cybersecurity Assessment Engineer to perform hands-on security assessments of software deployed through the Game Warden platform.\nThis is not a scan-operator or checklist-only position. We are looking for someone who can investigate technical findings, understand how an application is built and deployed, distinguish meaningful risk from scanner noise, and give engineering teams practical guidance they can act on.\nReporting to the Head of Product Security & Compliance, you will assess customer applications, container images, cloud configurations, software dependencies, and supporting artifacts before and after deployment. You will work directly with Product, Platform Engineering, DevOps, Mission Success, and customer development teams to identify vulnerabilities, evaluate their actual risk, and determine whether an application is ready to operate within Game Warden.\nYour work will directly influence deployment decisions, vulnerability remediation, continuous monitoring, and the security posture of a platform supporting mission-critical government software.\nNote: Candidates must reside in one of our approved hiring hubs:\nDC/Maryland/Virginia\nRaleigh/Durham/Chapel Hill, NC\nDenver/Colorado Springs, CO\nDallas/Fort Worth, TX This is a full-time position.\nWhat You'll Do\nPerform technical security assessments of customer applications and services seeking deployment through the Game Warden platform.\nReview application artifacts, container images, software dependencies, infrastructure configurations, data flows, APIs, and deployment documentation to identify security weaknesses.\nAnalyze results from SAST, DAST, software composition analysis, container scanning, infrastructure-as-code scanning, secrets detection, and vulnerability management tools.\nServe as a trusted technical security partner to Mission Success, Platform Engineering, DevOps, and customer development teams.\nPartner with Security Authorization Specialists to ensure technical assessment results and supporting evidence can be used for RMF, FedRAMP, and continuous monitoring activities.\nProvide developers with clear remediation guidance that identifies the vulnerable component, explains the risk, and recommends specific corrective actions.\nEvaluate requests for vulnerability exceptions or delayed remediation. Validate the stated rationale, examine compensating controls, and provide a documented risk recommendation to the appropriate approving authority.\nSupport recurring continuous monitoring reviews by identifying new vulnerabilities, configuration drift, outdated dependencies, and changes affecting previously assessed applications.\nCommunicate assessment results directly to technical and nontechnical stakeholders, including customers who may need help understanding findings and remediation expectations.\nProduce clear assessment records that document the scope, methodology, evidence reviewed, findings identified, risk analysis performed, and remediation status.\nWhat You Bring\nPosses 5 to 7 years of hands-on experience in application security, product security, vulnerability assessment, cloud security, penetration testing, DevSecOps, or a closely related technical security discipline.\nStrong understanding of common application and cloud vulnerabilities, including the OWASP Top 10, insecure configurations, dependency risk, secrets exposure, authentication weaknesses, authorization failures, and software supply chain threats.\nHands-on experience assessing applications or services deployed in AWS, Azure, or Google Cloud. Direct AWS experience is strongly preferred. Working knowledge of containers, Docker, Kubernetes, container registries, CI/CD pipelines, and modern software delivery practices.\nExperience using multiple security testing technologies, such as SAST, DAST, software composition analysis, container scanning, infrastructure-as-code scanning, secrets detection, and vulnerability scanners.\nThe ability to interpret CVEs, CVSS vectors, EPSS scores, CISA KEV entries, vendor advisories, exploit information, and other sources used to assess vulnerability risk.\nExperience reviewing SBOMs and investigating vulnerable open-source or third-party software dependencies.\nWorking knowledge of DISA STIGs, Security Requirements Guides, CIS Benchmarks, and secure configuration practices.\nPractical understanding of NIST SP 800-53, NIST SP 800-37, continuous monitoring, and the role technical assessment evidence plays in government authorization programs.\nThe ability to explain a technical finding clearly, defend a risk conclusion, and provide useful remediation guidance to software engineers and customers.\nSound judgment when working through incomplete information, conflicting scan results, and security issues without an obvious resolution.\nDemonstrated experience interpreting security scan results and independently validating whether reported vulnerabilities are accurate, reachable, and exploitable.\nThis position requires the ability to obtain and maintain a Public Trust determination.\nPreferred\nExperience supporting FedRAMP Moderate, FedRAMP High, DoD RMF, or other government authorization programs.\nExperience securing or assessing Kubernetes-based DevSecOps platforms, platform-as-a-service environments, or multi-tenant cloud services.\nFamiliarity with GitLab, Docker, Kubernetes, Terraform, Anchore, Trivy, Tenable, and cloud-native observability tooling.\nExperience working directly with software development teams to remediate vulnerabilities and improve secure development practices.\nCertifications such as Security+,CySA+, CSSLP, AWS Certified Security, Certified Kubernetes Security Specialist, GIAC, or comparable technical credentials.\nA strong interest in protecting national security systems and improving how mission software is evaluated and delivered. The base salary for this position will fall between $155,000 and $175,000. Your ultimate compensation will be determined by professional background, technical proficiency, seniority, and regional cost factors. Furthermore, this opportunity includes potential eligibility for equity awards and discretionary bonuses, rounding out a comprehensive total rewards offering.\nSuccess at 2F Looks Like:\nA proactive and solutions oriented mindset\nViewing obstacles as opportunities for growth\nHaving a bias toward action and tangible, measurable results\nBeing team-oriented with a focus on personal responsibility and autonomy\nPerks & Benefits:\nThis role is a full time position. As a public benefit corporation, we’re a team of purpose-driven trailblazers transforming the future of U.S. national security. We hire the best to do their best and, as such, we are committed to providing the perks and benefits you need to be successful-both in- and outside the workplace.\nPerks of Joining Our Team:\nCompetitive salary\n100% employer-paid medical, dental, and vision coverage for you and your dependents\n401(k) with a 3% company contribution\nComprehensive wellness benefits, including a One Medical membership, mental health resources, family planning support, and more\nEquity incentive plan\nNew hire technology and home office stipend\nAnnual professional development stipend\nFlexible paid time off, plus all federal holidays\nGenerous parental leave\nFlexible remote work opportunities\nEmployee referral bonus program Visit our careers page to learn more.\nWho We Are:\nSecond Front Systems (2F) is a public-benefit software company powering software for the free world. We eliminate the friction that slows innovation, enabling faster, more secure development and deployment of software across government and regulated networks. Built by national security veterans and backed by top-tier venture capital, our platform is trusted by the world’s leading organizations to cut deployment timelines from years to weeks. We move fast, solve hard problems, and deliver trusted capabilities where they’re needed most. Our work strengthens global security and gives the United States and its allies a lasting competitive advantage. Learn more at secondfront.com.\nOne last thing:\nWe are an equal opportunity employer and all qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity or expression, pregnancy, age, national origin, disability status, genetic information, protected veteran status, or any other characteristic protected by law.\nAre you ready to join our team:\nTo apply, click the “Apply for This Job” button at the top or bottom of this page and complete the application form. This position will remain open until filled, and applications will be reviewed on a rolling basis.\nState notices:\nColorado:\nIn accordance with Colorado law, applicants may redact their date of birth, dates of attendance, and dates of graduation from any uploaded documents.\nMaryland:\nUnder Maryland law, an employer may not require or demand, as a condition of employment, prospective employment, or continued employment, that an individual submit to or take a polygraph examination or similar test. An employer who violates this law is guilty of a misdemeanor and subject to a fine not exceeding $100.","description_format":"text","description_chars":9237,"description_truncated":false,"requirements":{"experience_years_min":5,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":true,"languages":[]},"benefits":["Equity","Home office","Parental leave","Professional development"],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"},{"name":"Texas","iso":null,"kind":"city"},{"name":"Virginia","iso":null,"kind":"city"},{"name":"Maryland","iso":null,"kind":"city"},{"name":"North Carolina","iso":null,"kind":"city"},{"name":"District of Columbia","iso":null,"kind":"city"},{"name":"Colorado","iso":null,"kind":"city"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Cybersecurity","Information Security","Digital Government","Security Compliance"],"lifecycle":[{"event":"open","at":"2026-07-17T19:58:02Z"}],"visa":[],"liveness":{"score":31,"band":"fade","label":"Fading","p_open":1,"p_active":0.867,"p_room":0.36,"age_days":90,"expected_fill_days":56,"reasons":["conf:3","velocity","win:tail","crowd:"],"computed_at":"2026-10-16T05:45:00Z"},"pay":{"stated_usd_annual":175000,"is_top_pay":true},"html_url":"https://alion.io/job/second-front-systems-cybersecurity-assessment-engineer","json_url":"https://alion.io/job/second-front-systems-cybersecurity-assessment-engineer.json","meta":{"generated_at":"2026-10-17T04:04:12Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":5343,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-18T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":58794},"rest":"https://alion.io/mcp/rest/get_company?id=58794"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fsecond-front-systems-cybersecurity-assessment-engineer"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fsecond-front-systems-cybersecurity-assessment-engineer"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fsecond-front-systems-cybersecurity-assessment-engineer"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/second-front-systems-cybersecurity-assessment-engineer\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fsecond-front-systems-cybersecurity-assessment-engineer"}]}