About the Role
Second Front Systems (2F) is seeking a motivated Cybersecurity Assessment Engineer to support our team. We are a fast-growing entrepreneurial team working at the convergence of technology and national security. The work will be dynamic and wide-ranging with cybersecurity, DevSecOps, and cloud infrastructure roles supporting the deployment and scale of our Game Warden platform.
As a Cybersecurity Assessment Engineer at Second Front Systems, you will help ensure that Game Warden maintains a strong security posture. You will work hand-in-hand with the DevOps Engineering and Mission Success teams to oversee the software vulnerability scanning process, review vulnerability scan results, assist the customers in understanding those results, and make approval recommendations for vulnerabilities that can't be immediately resolved.
What You’ll Do
You will coordinate activities with the Principal Security Engineer, Platform team, and Customer Operations team. Specific tasks include:
- Review web application artifacts of customer developed applications and provide customer feedback
- Primary face of the cybersecurity team to software development and mission success teams
- Assist with incident response plans to respond to application outages or downtime
- Technical Security Validation: Conduct comprehensive assessments of cloud infrastructure, applications, and containerized environments to verify compliance with DISA STIGs, SRGs, and CIS Benchmarks.
- Authorization Lifecycle Management: Author, review, and maintain high-quality security artifacts, including System Security Plans (SSP), Security Assessment Plans (SAP), and Security Assessment Reports (SAR).
- Continuous Monitoring (ConMon): Monitor and report on the ongoing effectiveness of security controls, ensuring the platform maintains a robust and authorized security posture.
- Vulnerability & Risk Analysis: Utilize automated scanning suites (e.g., Anchore, Trivy, Tenable) to identify vulnerabilities, distinguish true positives, and provide actionable remediation guidance to dev teams.
- Supply Chain Security: Implement and manage technical workflows for SBOMs (Software Bill of Materials) to support modern, continuous authorization standards.
- Cross-Functional Collaboration: Partner with DevOps and Software Engineering teams to translate complex NIST 800-53 controls into implementable technical requirements.
Skills You’ll Bring to Our Team
- Intermediate knowledge of DevSecOps tools and software development
- Hands-on experience assessing or securing services within AWS, Azure, or GCP, particularly within PaaS or Kubernetes-based environments
- Proficient knowledge of NIST SP 800-37 (RMF) and NIST SP 800-53 rev 5 security controls
- Deep understanding of the FedRAMP authorization process and Department of Defense (DoD) security standards
- Ability to write basic scripts (Python, Bash, etc.) to automate evidence collection or data parsing
- Experience with Docker, Gitlab, Kubernetes, Anchore, or other container scanning tools