senior cybersecurity analyst

application security engineer Jobs in Washington

application security engineer

cyber threat intelligence analyst (ts/sci req) Jobs in Washington

cyberark architect

cybersecurity cloud engineer Jobs in Washington

cybersecurity cloud engineer

security engineer

IT Security EngineerWe are seeking a highly skilled and proactive IT Security Engineer to take ownership of the organization&rsquo;s end-to-end security program. This individual will be responsible for protecting systems, data, and infrastructure while partnering cross-functionally to ensure security is embedded across all technology and business operations. This role reports directly to the IT Director.Key Responsibilities<ul><li>Own and manage the full lifecycle of the organization&rsquo;s cybersecurity program</li><li>Conduct penetration testing, vulnerability scanning, and ongoing risk assessments to identify and mitigate threats</li><li>Develop, implement, and maintain security policies, procedures, and compliance documentation</li><li>Ensure adherence to regulatory frameworks including GDPR and HIPAA, with future exposure to ISO standards</li><li>Lead incident response efforts, including investigation, containment, and remediation of security events</li><li>Collaborate with internal teams to integrate security into daily operations and new technology initiatives</li><li>Provide strategic input on the development and evolution of the organization&rsquo;s technology stack</li><li>Manage vendor relationships, including evaluating third-party security practices and overseeing audits</li><li>Oversee endpoint and system security, including patching, monitoring, and access controls</li><li>Partner with external security vendors (e.g., SOC, EDR) to monitor systems and respond to threats</li><li>Deliver security awareness training and guidance to end users to reduce risk and improve best practices</li><li>Support audits, security questionnaires, and compliance-related requests</li></ul>Technical Environment<ul><li>Microsoft Azure Active Directory supporting approximately 130 end users</li><li>Experience with cloud security, identity and access management, MFA, and endpoint protection tools</li></ul>Qualifications<ul><li>Bachelor&rsquo;s degree in Computer Science, Information Security, or related field (or equivalent experience)</li><li>5+ years of experience in cybersecurity or security engineering roles</li><li>Strong expertise in security technologies including firewalls, VPNs, SIEMs, IDS/IPS, and endpoint security</li><li>Experience with penetration testing, vulnerability management, and incident response</li><li>Familiarity with compliance frameworks such as GDPR, HIPAA, and general knowledge of ISO standards</li><li>Industry certifications such as CISSP, CISM, or similar are preferred</li></ul>Skills &amp; Competencies<ul><li>Strong analytical and problem-solving abilities with a proactive approach to risk mitigation</li><li>Excellent written and verbal communication skills, with the ability to translate technical concepts to non-technical stakeholders</li><li>High attention to detail and ability to manage multiple priorities in a fast-paced environment</li><li>Strong cross-functional collaboration and stakeholder management skills</li></ul>Additional Information<ul><li>Role requires local candidates with a hybrid schedule of three days onsite (Monday required)</li><li>Involves regular interaction with leadership and cross-functional teams across the organization</li><li>Interview process consists of three stages: initial virtual interview followed by two onsite meetings with technical leadership and executive team</li></ul>Pay: $130,000.00 - $170,000.00 per yearWork Location: Hybrid remote in Washington, DC 20036

IT Security Engineer

New Charter Technologies

<div>We believe talent deserves a human touch. Your application will be read by an actual person who&rsquo;s excited to discover the real you.
Application Security Engineer
Location: Remote (United States) | Employment Type: Full-Time
About the Role
We are looking for an Application Security Engineer to join our product engineering team. You will serve as the named security function for a team building internal tooling for a portfolio of managed service provider companies, with a roadmap toward a public-facing SaaS product. This role sits inside engineering and works closely with developers and information security day to day.
The team you are joining is experienced and moves quickly. The right person for this role is comfortable operating as a peer to strong engineers, contributing practical security judgment and ensuring overall security of our solutions. As our product matures toward public availability, you will help ensure our security posture scales with it.
You should be comfortable operating in an exploratory, innovation-oriented environment where not everything will become production software. Right-sizing your security posture to the actual risk is a core expectation of this role.
Key Responsibilities
Embedded Security Partnership<ul><li>Serve as the primary security resource for engineering teams in direct close coordination with information security teams, advising on design decisions, authentication patterns, and API security as features are built rather than after the fact</li><li>Conduct lightweight, developer-friendly threat modeling for new features and services, right-sized to the actual audience and risk profile (internal vs. public-facing)</li><li>Lead collaboration between engineering and information security teams through architecture and code reviews with actionable, specific guidance that helps teams ship, not slow down</li><li>Responsible for remediation and enforcement of security standards as set forth by the information security team</li><li>Define and maintain a tiered security standard that distinguishes expectations for internal tooling vs. production SaaS vs. public-facing products</li><li>Engage constructively with the enterprise security organization, translating between compliance and governance language and the engineering team's operational reality</li></ul>
Tooling &amp; Automation<ul><li>Responsible for adherence to GitHub Advanced Security (GHAS) configuration and security standards through ongoing tuning across code scanning, secret scanning, Dependabot, and security campaigns within GitHub Enterprise</li><li>Integrate security tooling into CI/CD pipelines as policy-as-code feedback loops, not manual gates</li></ul><ul><li>Develop and maintain GitHub Actions workflows with reusable, security-enforcing components</li><li>Drive remediation velocity metrics and coverage reporting across engineering teams</li></ul>
Cloudflare &amp; Azure Security<ul><li>Collaborate with information security teams to assess and secure workloads across both Cloudflare and Azure, including Cloudflare Workers, Access policies, WAF, and Zero Trust for public-facing infrastructure, and Azure security controls (Managed Identities, Key Vault, Defender, IAM) for internal and opco-facing services</li><li>Apply platform-appropriate security controls as our architecture spans both environments, calibrating to the risk profile of each workload</li><li>Evaluate and harden authentication flows, API security patterns, and service-to-service trust boundaries across Cloudflare and Azure environments</li><li>Contribute to container and cloud workload security as infrastructure patterns evolve</li></ul>
Development Contributions<ul><li>Contribute to internal security tooling, automation, and integrations using Python and/or Go</li><li>Build security utilities such as vulnerability aggregation pipelines, policy enforcement tooling, or developer-facing security dashboards</li><li>Collaborate with information security and engineering teams on secure service design patterns, OAuth 2.0/OIDC flows, and API security controls</li></ul>
Compliance &amp; Risk<ul><li>Support SOC 2 readiness as the product matures toward public customers, mapping application security controls to Trust Services Criteria</li><li>Triage and prioritize vulnerability findings based on actual business risk rather than CVSS scores alone, distinguishing real issues from noise in a SaaS-native environment</li><li>Partner with GRC and the enterprise security organization on evidence collection and audit preparation, without allowing compliance prep to dominate engineering time</li></ul>
Required Qualifications<ul><li>7+ years in application security, secure software development, or a closely related discipline</li><li>Demonstrated ability to operate as an embedded security partner within engineering, working side by side with developers</li><li>Deep, hands-on experience with GitHub Advanced Security or equivalent security tooling, including code scanning, secret scanning, Dependabot, and security policy enforcement within GitHub Enterprise</li><li>Experience with threat modeling methodologies (STRIDE, PASTA, or similar) applied to real-world systems, with instinct for right-sizing the process to actual risk</li><li>Proficiency in Python and/or Go, comfortable reading, writing, and reviewing production-grade code</li><li>Strong command of OWASP Top 10, common vulnerability classes, and secure design principles</li><li>Experience securing SaaS or product engineering workloads rather than enterprise IT or perimeter-focused environments</li><li>Experience securing workloads on Cloudflare (WAF, Access, Zero Trust, Workers) and Microsoft Azure (IAM, Managed Identities, Key Vault, Defender), with demonstrated depth in one and working familiarity in the other</li><li>Solid understanding of container security concepts with hands-on Docker experience</li><li>Excellent communication skills, with the ability to translate complex security risk into developer-actionable guidance and executive-level business context</li><li>Familiarity with SOC 2 Trust Services Criteria and how application security controls map to compliance requirements</li></ul>
Expected Compensation to be $160k and up Dependent on Experience.
Preferred Qualifications<ul><li>Experience with DAST tooling (e.g., OWASP ZAP, Burp Suite Pro) integrated into automated pipelines</li><li>Familiarity with infrastructure-as-code security scanning (Terraform or similar)</li><li>Experience with API security standards including OAuth 2.0, OpenID Connect, and API gateway security patterns</li><li>Relevant certifications such as CSSLP, GWEB, or OSCP</li><li>AI/LLM security awareness, with a practical understanding of how AI-powered applications introduce unique security considerations including prompt injection, data exposure, and model supply chain risks</li><li>Familiarity with MCP (Model Context Protocol) server architectures and the security implications of LLM-to-tool integrations</li><li>Exposure to OWASP Top 10 for LLM Applications or similar emerging AI security frameworks</li></ul>
What Success Looks Like
In this role, success means developers ship more secure code faster, not slower. You earn trust by speaking the language of engineering, making the secure path the easy path, and knowing when to raise a flag versus when to let something ship. You apply proportionate security judgment across a spectrum from exploratory internal tooling to production SaaS, and you never mistake compliance theater for actual security.
The ideal candidate brings the depth to identify serious security issues, the engineering credibility to help teams fix them at scale, and the pragmatism to distinguish real risk from noise in a SaaS-native, developer-first environment.
Who We are:
At New Charter, we&rsquo;re building a caliber of business the IT industry hasn&rsquo;t yet seen. We are serving small-to-medium sized businesses in 10+ industries across North America, and we deliver best-in-class technology solutions to propel our clients into the digital world.
At New Charter Technologies, we&rsquo;re investing in our people &ndash; through growth and learning initiatives, employee benefits, company innovation, and more. We are constantly seeking a diverse candidate backgrounds and perspectives to amplify inclusive hiring practices for each job opening. Our partner companies have career paths for many different role types, whether you want to be deeply technical or whiteboarding with clients, and we are committed to developing fulfilling career paths for all contributors at New Charter Technologies. (Please note: Every application submitted through Workday is reviewed by a real person, not an AI. We value your time and take each submission seriously.)
Our teams are dedicated to pioneering breakthrough technologies, disruptive solutions, and transformative strategies. We&rsquo;re the architects of change, fostering an environment where bold ideas take flight, and creativity knows no bounds. At New Charter Technologies, we&rsquo;ve embraced the idea that every individual brings something special to the table. Our foundation is based on the belief that each team member plays a crucial role in our collective success.
Ready to be part of a dynamic and supportive community where your unique skills and personality shine? We&rsquo;re on a mission to make a difference, and we want you to be part of the story. Let&rsquo;s transform the world together and build a career that&rsquo;s as unique as you are!
We are looking for driven and passionate people who are excited to work in an incredibly rewarding environment. So, if you are ready to learn, be inspired, solve problems, and grow professionally, apply today! Learn more here: Why New Charter.
New Charter Technologies is committed to creating an inclusive environment and is proud to be an equal opportunity employer. New Charter recruits, employs, trains, compensates, and promotes regardless of race, color, religion, sex, sexual orientation, gender identity, national origin, veteran, or disability status.</div>

Application Security Engineer

Quzara LLC

<div>Job Title: Network and Edge Security Engineer
Pay Type: SALARIED EXEMPT
Location: Hybrid, Washington, DC (Must Work East Coast Hours)
Citizenship: U.S. Citizenship (Required)
Summary of Position Role/Responsibilities
The Network and Edge Security Engineer is responsible for designing, implementing, and supporting secure network and edge architectures across enterprise, cloud, and hybrid environments. This role focuses on establishing secure connectivity, enforcing segmentation strategies, and integrating network security controls with enterprise security tooling, while ensuring alignment with Zero Trust principles, enterprise security standards, and federal compliance requirements such as NIST, FISMA, and FedRAMP. The ideal candidate should possess hands-on experience in network security engineering, secure architecture design, and operational support of network and edge security controls within regulated environments.
Essential Functions of the Job<div><ul><li>
Support the design and implementation of secure enterprise, cloud, and edge network architectures, ensuring scalability and resilience.</li><li>
Implement and manage network security controls, including firewalls, secure gateways, VPNs, and Zero Trust Network Access (ZTNA) solutions.</li><li>
Configure and monitor network segmentation, including DMZ architectures and micro-segmentation strategies.</li><li>
Integrate network security controls with enterprise platforms such as Identity and Access Management (IAM), SIEM, SOAR, and SOC tooling.</li><li>
Ensure network configurations and controls align with NIST, FISMA, and FedRAMP requirements.</li><li>
Develop and maintain network security diagrams, standard operating procedures (SOPs), and technical documentation.</li><li>
Collaborate with Security Engineering, DevSecOps, and Compliance teams to ensure consistent enforcement of security controls across environments.</li><li>
Support troubleshooting and resolution of network security issues impacting system availability or compliance posture.</li></ul></div>
Marginal Functions of the Job<div><ul><li>
Other duties as assigned</li></ul></div>
Normal Work Schedule:
This full-time role runs Monday to Friday, 8:30 AM&ndash;5:30 PM and requires flexibility to work remotely or on-site (if applicable per client RTO policies). On occasion additional hours may be necessary.
Education, Training, and Experience<div><ul><li>
Bachelor&rsquo;s degree in Cybersecurity, Information Technology, Computer Science, or a related field.</li><li>
4&ndash;6+ years of experience in network security engineering or infrastructure security roles.</li><li>
Hands-on experience implementing and managing firewalls, VPNs, secure gateways, and network segmentation controls.</li><li>
Familiarity with Zero Trust architecture principles and secure connectivity models.</li><li>
Experience integrating network controls with IAM, SIEM, SOAR, and SOC environments.</li><li>
Working knowledge of federal compliance frameworks such as NIST SP 800-53, FISMA, and FedRAMP.</li><li>
Experience developing technical documentation, architecture diagrams, and operational procedures.</li><li>
Strong troubleshooting and analytical skills in network and security domains.</li><li>
Must be a U.S. Citizen and eligible to support federal contracting environments.</li></ul></div>
Preferred Certifications<div><ul><li>
Cisco Certified Network Professional (CCNP Security) or equivalent</li><li>
CompTIA Security+, Network+, or similar certifications</li><li>
Cloud-related certifications (e.g., Azure Network Engineer Associate (AZ-700), AWS Advanced Networking) are also a plus</li></ul></div>
EEO Statement
The Company is an Equal Employment Opportunity (EEO) employer and does not discriminate based on race, color, religion, sex, sexual orientation, national origin, age, marital status, disability, veteran's status, or any other basis protected by applicable discrimination laws.</div>

Network & Edge Security Engineer

<div>Description<div><div>
Our Digital Modernization Division is an information technology and management consulting department that offers integrated, strategic solutions to its public and private-sector clients. ICF has the expertise, agility, and commitment to design, build, and operate high-performance IT engines to support all aspects of our client&rsquo;s business.
ICF is seeking an experienced and driven Software Security Engineer to lead and oversee mission-critical initiatives in support of the General Service Administration (GSA). In this role, you will help safeguard applications and cloud-based systems by integrating security best practices throughout the software development lifecycle.
Job Location: Must be able to go on-site 5 days a week to the client's office in Washington, DC. Hybrid work flexibility may be available after the first 90 days.
What You Will Do:<ul><li>
Integrate security best practices throughout the software development lifecycle (SDLC) for applications and cloud environments</li><li>
Perform secure code reviews and vulnerability assessments using industry‑standard tools, including SAST, DAST, and SCA solutions</li><li>
Design, implement, and validate security controls within cloud environments such as AWS and AWS GovCloud</li><li>
Identify security weaknesses, prioritize risks, and support remediation efforts to ensure compliance with federal security requirements</li><li>
Support systems operating in regulated and high‑security environments</li><li>
Conduct research and provide recommendations on emerging security threats, tools, and best practices</li><li>
Collaborate with development, DevOps, and compliance teams to ensure secure system design and implementation</li><li>
Lead or guide teams in resolving compliance gaps and security findings under tight deadlines</li></ul>
What You Will Bring With You:
<ul><li>Bachelor&rsquo;s degree in Computer Science, Engineering, Information Systems, or related technical field</li><li>
Professional certifications: CISSP, CISM, CISA, Security+, or GIAC certifications</li><li>
5 years experience with working on/around cloud platforms in AWS.</li><li>
Must be able to obtain and maintain a Public Trust clearance.</li><li>
MUST RESIDE IN THE United States (U.S.) and the work MUST BE PERFORMED in the United States (U.S.) as this work is for a federal contract, and laws do apply.</li></ul>
What We Would Like You To Bring With You:<ul><li>
Hands-on experience performing secure code reviews and vulnerability assessments using industry-standard tools (e.g., SAST, DAST, SCA).</li><li>
Experience implementing security controls in cloud environments (e.g., AWS GovCloud or similar secure federal cloud environments).</li><li>
Strong understanding of secure coding standards (e.g., OWASP, NIST, DoD STIGs).</li><li>
Experience supporting systems within regulated or high-security environments.</li><li>
Ability to self-organize, priorities and conduct research on multiple projects under tight deadlines in a fast-paced environment.</li><li>
Experience supporting and maintaining CATO</li><li>
Understanding of the GSA FedRamp process</li><li>
Experience with NIST Cybersecurity Framework or similar security frameworks</li><li>
Ability to lead and direct teams to remediate compliance issues</li></ul></div></div>
Working at ICF
ICF is a global advisory and technology services provider, but we&rsquo;re not your typical consultants. We combine unmatched expertise with cutting-edge technology to help clients solve their most complex challenges, navigate change, and shape the future.<div>
We can only solve the world's toughest challenges by building a workplace that allows everyone to thrive. We are an equal opportunity employer. Together, our employees are empowered to share their expertise and collaborate with others to achieve personal and professional goals. For more information, please read our EEO policy.
We will consider for employment qualified applicants with arrest and conviction records. 
Reasonable Accommodations are available, including, but not limited to, for disabled veterans, individuals with disabilities, and individuals with sincerely held religious beliefs, in all phases of the application and employment process. To request an accommodation, please email Candidateaccommodation@icf.com and we will be happy to assist. All information you provide will be kept confidential and will be used only to the extent required to provide needed reasonable accommodations.</div><div>
Read more about workplace discrimination rights or our benefit offerings which are included in the Transparency in (Benefits) Coverage Act.</div><div> 
Candidate AI Usage Policy</div><div><div>
At ICF, we are committed to ensuring a fair interview process for all candidates based on their own skills and knowledge. As part of this commitment, the use of artificial intelligence (AI) tools to generate or assist with responses during interviews (whether in-person or virtual) is not permitted. This policy is in place to maintain the integrity and authenticity of the interview process.</div><div>
However, we understand that some candidates may require accommodation that involves the use of AI. If such an accommodation is needed, candidates are instructed to contact us in advance at candidateaccommodation@icf.com. We are dedicated to providing the necessary support to ensure that all candidates have an equal opportunity to succeed.</div></div> 
Pay Range - There are multiple factors that are considered in determining final pay for a position, including, but not limited to, relevant work experience, skills, certifications and competencies that align to the specified role, geographic location, education and certifications as well as contract provisions regarding labor categories that are specific to the position.
The pay range for this position based on full-time employment is:
$108,006.00 - $183,610.00
DC Client Office (DC88)</div>

Software Security Engineer (Public Trust)

Williams & Connolly LLP

Williams & Connolly LLP is seeking a highly experienced Senior Identity & Cloud Security Engineer to join its Information Security team. Reporting to the Chief Information Security Officer (CISO), this role is responsible for the architecture, engineering, and continuous improvement of the firm's identity, cloud, and SaaS security posture, with primary emphasis on identity as the control plane.
 
This position requires deep, hands-on expertise in cloud identity platforms, SaaS access governance, Zero Trust architectures, and modern authentication and authorization controls. The role operates with significant autonomy and exercises independent judgment in designing and implementing security controls that protect sensitive legal and client data.
 
Responsibilities Include: 
Identity & Access Management
 <ul>
<li>Architect, implement, and operate enterprise-grade identity and access management (IAM) solutions across cloud and SaaS platforms.</li>
<li>Design and enforce Zero Trust identity controls, including MFA, conditional access, device trust, least privilege, and risk-based authentication.</li>
<li>Own identity lifecycle management, including provisioning, deprovisioning, access reviews, and privileged access management (PAM).</li>
<li>Secure and govern SaaS applications through SSO, federation, SCIM, and access policy enforcement.</li>
<li>Lead identity hardening initiatives across Azure Entra ID (Azure AD) and other cloud identity platforms.</li>
<li>Familiarity with cloud pen testing tools to address weaknesses and vulnerabilities</li>
</ul>
Cloud & SaaS Security Architecture
 <ul>
<li>Define and maintain security architecture standards for cloud (IaaS/PaaS) and SaaS environments, with a strong emphasis on identity-first design.</li>
<li>Partner with IT and application owners to securely onboard new cloud and SaaS services.</li>
<li>Evaluate emerging cloud and identity technologies and make recommendations aligned with firm risk tolerance and business needs.</li>
<li>Provide guidance on cloud security governance, configuration standards, and secure design patterns.</li>
</ul>
Security Operations & Risk
 <ul>
<li>Identify, assess, and prioritize identity- and cloud-related vulnerabilities; validate remediation and risk acceptance decisions.</li>
<li>Support incident response activities related to identity compromise, SaaS misuse, and cloud security events.</li>
<li>Review higher-risk applications and integrations to ensure compliance with security policies and identity standards.</li>
<li>Assist with client security assessments and due diligence requests, particularly related to identity, access controls, and cloud security posture.</li>
</ul>
Policy, Compliance & Enablement
 <ul>
<li>Develop and maintain security policies, standards, and procedures related to identity and cloud security.</li>
<li>Support compliance initiatives aligned with frameworks such as ISO 27001, NIST, and client-driven security requirements.</li>
<li>Contribute to security awareness efforts with a focus on authentication hygiene and access risk.</li>
<li>Bachelor's degree in Computer Science, Information Systems, or a related field (or equivalent professional experience).</li>
<li>8+ years of progressive experience in information security, with deep specialization in identity, cloud, and SaaS security.</li>
<li>Desire to mentor and train junior team members, fostering skill development and knowledge sharing across the team.</li>
<li>Demonstrate hands-on experience with Azure Entra ID (Azure AD); experience with AWS and other cloud platforms is a plus.</li>
<li>Strong understanding of modern IAM concepts, including federation, OAuth/OIDC, SAML, SCIM, conditional access, and Zero Trust.</li>
<li>Proven ability to design and implement secure, scalable identity architectures in complex environments.</li>
<li>Strong scripting and automation skills (e.g., PowerShell, APIs); infrastructure-as-code and identity automation experience preferred.</li>
<li>Excellent written and verbal communication skills, with the ability to explain complex security concepts to technical and non-technical stakeholders.</li>
</ul>
Certifications
 <ul>
<li>CISSP (required)</li>
<li>Cloud and identity-focused certifications strongly preferred, such as: Microsoft Azure Security, Engineer / Identity certifications, CCSP, or Equivalent advanced cloud security certifications.</li>
</ul>
Work is performed in a professional office environment and requires the following:
 <ul>
<li>Prolonged periods using a sit-to-stand desk and working on a computer.</li>
<li>Repetitive movements, including typing on a keyboard and using a mouse.</li>
<li>Ability to lift and carry up to 25lbs.</li>
<li>Employee must be able to perform the essential functions of this position with or without a reasonable accommodation.</li>
</ul>
The anticipated annual salary range for this position is $200,000 - $220,000. This is an exempt position. The hours are 9:00 a.m. - 5:30 p.m. Candidates must have the ability to work additional hours as needed. The final offer amount is dependent on a variety of factors including, but not limited to, years of experience, education, and other relevant skills and qualifications. Williams & Connolly LLP offers competitive compensation and benefits packages.

Senior Identity and Cloud Security Engineer

<div>Job Title: Cybersecurity Cloud Engineer
Pay Type: SALARIED EXEMPT
Location: Hybrid, Washington, DC (Must Work East Coast Hours)
Citizenship: U.S. Citizenship (Required)
Summary of Position Role/Responsibilities
The Cybersecurity Cloud Engineer is responsible for designing, implementing, and maintaining secure cloud environments across Quzara&rsquo;s federal and commercial platforms. This role emphasizes deploying and managing cloud-native security controls, integrating cloud telemetry with security operations tools, and ensuring ongoing compliance with federal standards such as NIST, FedRAMP, and agency-specific policies. The position supports secure architectures in IaaS, PaaS, and SaaS environments, requiring hands-on expertise in cloud security services, strong knowledge of security operations integration, and the ability to drive both engineering and compliance initiatives.
Essential Functions of the Job<div><ul><li>
Implement and support secure cloud architectures aligned with NIST, FedRAMP, and agency-specific security policies.</li><li>
Support the design and maintenance of cloud security reference architectures across platforms such as AWS and Microsoft Azure.</li><li>
Configure and maintain cloud-native security services and controls, including identity, logging, monitoring, and threat protection capabilities.</li><li>
Integrate cloud telemetry and logging data into SIEM and Security Operations (SecOps) platforms to support monitoring and detection activities.</li><li>
Support cloud security incident detection, investigation, and remediation in coordination with SOC and incident response teams.</li><li>
Assist in the enforcement of continuous compliance requirements, including validation of control implementation and support for audit readiness.</li><li>
Produce and maintain cloud security documentation, including system diagrams, architecture artifacts, and control narratives.</li><li>
Collaborate with engineering, DevSecOps, and compliance teams to ensure alignment between cloud implementations and security requirements.</li></ul></div>
Marginal Functions of the Job<div><ul><li>
Other duties as assigned</li></ul></div>
Normal Work Schedule:
This full-time role runs Monday to Friday, 8:30 AM&ndash;5:30 PM and requires flexibility to work remotely or on-site (if applicable per client RTO policies). On occasion additional hours may be necessary.
Education, Training, and Experience<div><ul><li>
Bachelor&rsquo;s degree in Cybersecurity, Information Technology, Computer Science, or a related field.</li><li>
3&ndash;5+ years of experience supporting cloud security engineering or cloud infrastructure in regulated environments.</li><li>
Hands-on experience with cloud platforms such as AWS and/or Microsoft Azure.</li><li>
Familiarity with federal cybersecurity frameworks including NIST SP 800-53 and FedRAMP.</li><li>
Experience configuring cloud-native security tools (e.g., identity and access controls, logging, monitoring, and threat protection services).</li><li>
Experience integrating cloud environments with SIEM or SecOps platforms.</li><li>
Ability to produce technical documentation, diagrams, and security artifacts.</li><li>
Strong analytical and problem-solving skills, with the ability to support incident response and remediation efforts.</li><li>
Must be a U.S. Citizen and eligible to support federal contracting environments.</li></ul></div>
Preferred Certifications<div><ul><li>
Cloud and security certifications such as:<ul><li>
AWS Certified Solutions Architect</li><li>
Microsoft Certified: Azure Security Engineer Associate (AZ-500)</li><li>
CompTIA Security+</li></ul></li><li>
Additional certifications related to cloud security or compliance frameworks are also a plus.</li></ul></div>
EEO Statement
The Company is an Equal Employment Opportunity (EEO) employer and does not discriminate based on race, color, religion, sex, sexual orientation, national origin, age, marital status, disability, veteran's status, or any other basis protected by applicable discrimination laws.</div>

Cybersecurity Cloud Engineer

THUNDERYARD SOLUTIONS

Job Description:The U.S. Department of the Treasury is seeking an experienced Lead Business Process Engineer to design, operationalize, and implement a comprehensive Security Development Lifecycle (SDL) framework as part of the Treasury Enterprise Cyber Consolidation initiative. This critical role will ensure security is embedded throughout the software development lifecycle for all Treasury applications, enhancing the Department's security posture while achieving compliance with federal regulations and standards.The Lead Business Process Engineer will be responsible for conducting discovery across all existing SDL services at Treasury, identifying gaps in current application security practices, and designing a tailored SDL framework that integrates security best practices into every phase of development. This position requires translating complex security requirements and industry standards into practical, repeatable processes that development teams can adopt while maintaining alignment with Treasury's strategic cybersecurity objectives and the broader Treasury Common Services Center (TCSC) implementation.Key Responsibilities:<ul><li>SDL Framework Design: Develop a comprehensive application-layer Security Development Lifecycle framework tailored to Treasury's unique requirements, mission context, and regulatory environment, ensuring security is integrated from requirements gathering through deployment and maintenance</li><li>Current-State Discovery: Conduct thorough discovery of all component SDL services, security practices, and procedures currently incorporated into existing application development lifecycles across Treasury Bureaus</li><li>Gap Analysis and Recommendations: Identify gaps in current SDL coverage and recommend updates or additions to SDL services, methods, and techniques based on industry best practices, NIST guidance, and applicable regulatory, legal, or statutory requirements</li><li>Process Documentation: Create detailed SDL guidance documentation including process workflows, security gates, approval criteria, roles and responsibilities, and integration points with existing development methodologies (Agile, DevOps, Waterfall)</li><li>Security Requirements Integration: Define security requirements and acceptance criteria for each SDL phase, including threat modeling, secure design principles, secure coding standards, security testing requirements, and vulnerability remediation processes</li><li>Tool and Automation Strategy: Recommend and integrate security tools into the SDL framework including static application security testing (SAST), dynamic application security testing (DAST), software composition analysis (SCA), and container security scanning</li><li>Stakeholder Engagement: Collaborate with application development teams, security architects, ISSOs, system owners, and Bureau stakeholders to validate SDL processes and secure adoption across the enterprise</li><li>Training and Enablement: Develop training materials, playbooks, and job aids to support developer adoption of SDL practices and ensure consistent implementation across Treasury</li><li>Metrics and Continuous Improvement: Establish SDL performance metrics and maturity indicators to measure adoption, effectiveness, and security outcomes, enabling continuous refinement of the framework</li><li>Compliance Alignment: Ensure SDL framework supports compliance with NIST SP 800-53 Rev. 5, NIST Secure Software Development Framework (SSDF), OMB M-22-18, and other applicable federal secure development requirements</li></ul>Required Requirements:<ul><li>Minimum 7 years of experience in application security, secure software development, or DevSecOps roles</li><li>Minimum 5 years of experience designing or implementing Security Development Lifecycle frameworks, secure SDLC programs, or application security processes in enterprise environments</li><li>Demonstrated experience conducting application security assessments, threat modeling, and secure code reviews</li><li>Proven track record implementing security testing tools (SAST, DAST, SCA) and integrating security into CI/CD pipelines</li><li>Experience with federal government application security requirements and compliance frameworks</li><li>Strong background in software development methodologies (Agile, DevOps, Waterfall) and development lifecycle management</li><li>Experience working with cross-functional teams including developers, architects, security teams, and business stakeholders</li><li>Expertise with DevSecOps practices and security automation in CI/CD pipelines</li><li>Knowledge of federal compliance requirements including NIST SP 800-53 controls related to application security (SA, SI, SC families)</li><li>Experience with Microsoft Visio</li><li>Professional Competencies:</li><li>Excellent communication skills with ability to engage both technical and non-technical stakeholders</li><li>Strong analytical and problem-solving capabilities</li><li>Experience facilitating workshops and working sessions with development teams</li><li>Ability to balance security requirements with development velocity and business needs</li><li>Demonstrated ability to drive adoption of new processes and practices across organizations</li><li>Ability to obtain and maintain a federal security clearance (Secret or higher)</li></ul>Preferred Requirements:<ul><li>Active Public Trust for Department of Treasury</li><li>Advanced Certifications:</li></ul>&ndash; Master's degree in Business, Computer Science, Cybersecurity, Software Engineering, or related field&ndash; Offensive Security Certified Professional (OSCP) or similar penetration testing certification&ndash; Certified Ethical Hacker (CEH)&ndash; AWS Certified Security Specialty or Azure Security Engineer Associate&ndash; GIAC Cloud Security Automation (GCSA)&ndash; Certified DevSecOps Professional (CDP)<ul><li>Prior experience with Treasury or other Cabinet-level federal agency application security programs</li><li>Experience implementing SDL frameworks aligned to NIST SSDF or similar federal secure development standards</li><li>Published thought leadership on secure development, DevSecOps, or application security</li><li>Knowledge of FedRAMP security requirements for cloud applications</li><li>Experience with container orchestration security (Kubernetes, Docker) and infrastructure-as-code security</li><li>Familiarity with Treasury-specific applications, development environments, or compliance requirements</li><li>Experience with ServiceNow Security Operations or GRC modules for application security tracking</li><li>Understanding of microservices security architecture and zero trust application design</li><li>Experience with SAFe (Scaled Agile Framework) or other enterprise agile methodologies</li><li>Knowledge of CMMI for Development or similar maturity models</li></ul>Required Education &amp; Certifications:<ul><li>Bachelor's degree in Business, Computer Science, Software Engineering, Information Security, or related field</li><li>One or more of the following certifications required:</li></ul>&ndash; Certified Secure Software Lifecycle Professional (CSSLP)&ndash; Project Management Professional&ndash; Lean Six Sigma Green Belt or GreaterCompensation:The salary for this role is budgeted at $120,000-$140,000 annually, plus benefits. ThunderYard offers benefits including medical, dental and vision insurance, 401k matching, PTO, certification reimbursement and more.VettingCandidates selected will be subject to a background investigation for clearance eligibility by our government client.ThunderYard Solutions is proud to be an Equal Opportunity Employer. We don&rsquo;t just accept difference &ndash; we celebrate it, we support it, and we thrive on it for the benefit of our employees, our community, and our customers. All applicants will be considered for employment without discrimination of race, color, religion, or belief, national, social, or ethnic origin, sex, age, physical, mental, or sensory disability, HIV status, sexual orientation, gender identity and/or expression, marital, civil union, or domestic partnership status, protected veteran status, family medical history or genetic information.Job Type: Full-timePay: $120,000.00 - $140,000.00 per yearBenefits:<ul><li>401(k)</li><li>401(k) matching</li><li>Dental insurance</li><li>Employee assistance program</li><li>Flexible schedule</li><li>Health insurance</li><li>Health savings account</li><li>Paid time off</li><li>Professional development assistance</li><li>Referral program</li><li>Vision insurance</li></ul>Work Location: Hybrid remote in Washington, DC 20590

Lead Business Process Engineer- IRS (DC)

Explore 132+ Security engineer in Washington this April. Find roles across top companies and apply now to boost your career.