Senior Security Engineer (Cleared)

Title: Senior Security Engineer (Cleared) Location: Colorado Springs, CO (hybrid) or Los Angeles, CA (hybrid)

About the role

We are hiring a Senior Security Engineer to own security across both the build pipeline and the authorization package across multiple teams and program domains. You will design and harden the cloud infrastructure and CI/CD that ships our software, translate whole regulatory frameworks into code, drive program-wide Continuous ATO (cATO) adoption, and automate evidence gathering for data-driven risk reduction.

This is hands-on engineering focused. Most organizations split this work between a security engineer who’s abstracted from compliance and a compliance SME who rarely works embedded within the development team. With compliance and authorizations viewed as a part of continuous delivery and continuous compliance, these roles are blended into one. As a Senior Security Engineer, you own the outcomes for security and compliance for delivery.

What you will own 

Delivery pipeline and cloud infrastructure

• Own the CI/CD pipelines that deliver production software across teams, including build integrity, SLSA artifact signing, and least-privilege pipeline credentials.
• Set the secure golden path patterns and landing zone architectures across AWS GovCloud / Azure GCC High environments, enforcing Zero Trust principles in code.
• Secure the software supply chain across the program: dependency scanning, secret detection, SBOM generation, provenance verification, and pinned build actions.
• Harden container and orchestration layers from base image selection through admission control policies (Kyverno, OPA Gatekeeper).

Controls as code

• Translate whole control frameworks (NIST 800-53, CMMC, FedRAMP, DISA CC SRG) into automatable technical checks, building implementations rather than documenting manual processes.
• Decide where control gates sit and what they block, ensuring changes that break controls fail builds automatically before reaching assessment.
• Threat model complex distributed systems and carry mitigations directly through to running code and automated guardrails.
• Build and lead the adoption of agentic/AI-driven security tooling across teams, applying rigorous engineering judgment to AI safety and utility.

Evidence and authorization

• Own the evidence system across the program, establishing continuous collection from cloud APIs, CI/CD runners, and scanner feeds so posture derives from live data.
• Author control implementation statements and inherited-versus-owned boundary splits at a level of quality that assessors accept without rework.
• Drive Continuous RMF and cATO practices, keeping security posture reportable on demand and maintaining real-time POA&M status.
• Implement unified control libraries so a single technical check satisfies NIST 800-53, SOC 2, and ISO 27001 simultaneously.
• Train, mentor, and foster growth for security engineers across the practice.

What we need you to have 

• 6–10 years of experience in cloud/platform operations, DevSecOps, or security engineering.
• Deep technical fluency in the security surface of major cloud platforms (AWS GovCloud, Azure GCC High), including where default settings are insecure.
• Hands-on pipeline construction: you have built and hardened production CI/CD platforms, not merely consumed them.
• Infrastructure as Code (Terraform) as your standard method for managing infrastructure and security controls.
• Direct experience applying control frameworks (NIST 800-53, FedRAMP, CMMC) to real production systems.
• Strong programming capability in Python, Go, or Rust at the level required to build custom security tools, admission controllers, and evidence pipelines.
• The ability to hold both vocabularies fluently: stating controls to developers as system requirements and pipeline gates to assessors as control satisfaction.

Certifications & DoD 8140 Compliance

• Rise8 Standard: No certification is required to interview or receive an offer. We evaluate candidates on practical engineering capabilities, code delivery, and compliance problem-solving—not test scores.
• Contract Requirements (DoD 8140 / 8570): Specific customer engagements and Department of Defense programs may require an approved baseline certification (e.g., DoD 8140.03 / 8570.01-M) to obtain elevated administrative privileges or access to customer enclaves. Candidates already holding an applicable certification will be eligible for immediate deployment to these contracts. For candidates hired without one, Rise8 will support and sponsor obtaining the required credential if assigned to a billable role that mandates it.
• Relevant baseline credentials worth mentioning (DoD IAT Level III / CSSP / IAM Level III aligned): CISSP, CKS, CCSP, AWS Security – Specialty, Red Hat RHCE, GIAC (GSLC/GCIH), or equivalents.

What helps 

• Direct experience carrying an ATO or cATO package end to end (SSP authoring, POA&M management, continuous monitoring).
• Experience in Federal Agency Environments (CMS, VA, IRS, DOC, DOJ, etc.)
• Experience in DoD Software Factory environments (Platform One, Space CAMP, Kessel Run) and Impact Level (IL4/IL5/IL6) requirements.
• Experience in either private or public sector GRC Engineering.

Travel

Position may require up to 25% travel in support of contract performance, customer site visits, and program activities.

Salary 

The annual salary range for this role as it is posted is $143,824 - $179,780 regardless of final candidate location within the United States. The final job level and annual salary will be determined based on the education, qualification, knowledge, skills, ability, and experience of the final candidate(s), and calibrated against relevant market data and internal team equity.

Benefits

• Flexible schedule in a 100% distributed workforce
• Premium Insurance: We cover up to 100% of the employee premium and up to 80% of the combined dependent premium on our base health plan, depending on pay band. We also cover 100% of the premium for employee and dependent Dental and Vision as well as employee premiums for Life and Disability coverage.
• Retirement: 401k match at 10% gross pay.
• Paid time off (PTO): 4 weeks combined accrued vacation and sick leave, 11 Federal holidays, your birthday, jury duty, and bereavement.
• Education & Training: Accrued budget of up to $3,500 per year for classes, travel, events, and materials.
• Home Office and Merch: We offer $750 per year for home office technology and equipment as well as $100 per year for Rise8 merch from our Swag Store.
• Wellness Budget: To encourage and support a well-rounded healthy lifestyle, we cover 100% reimbursement on a variety of wellness activities and products, up to $500 per calendar year.
• Rise8 is part of the Life Time Corporate Partner program. In lieu of your $500 annual wellness benefit, you can instead get a $75 monthly credit towards a Life Time membership ($900 annual benefit).
• Equipment: We offer a MacBook Pro