• Deliver major features and architectural improvements across the Add-ons stack, including automated moderation pipelines, Reviewer tools, and DevHub. • Create robust observability systems and data-backed insights. • Provide peer feedback, share knowledge and help others grow. • Improve platform reliability through deployments, monitoring, and incident response. • Help keep the platform safe and trustworthy, with attention to security and user trust. • Step in to resolve issues impacting users and developers, from small bugs to larger incidents. • Collaborate with designers, product managers, QA, and community contributors to deliver end-to-end improvements. • Contribute in the open through pull requests, code reviews, and discussions.

• Provide leadership in the Product Security Program • Understand current product security state and define future strategies • Promote security architecture in product strategy • Conduct security architecture reviews • Perform Threat Modeling and document product risks • Maintain and mature Product Security tooling • Conduct code reviews and provide guidance on vulnerability management • Provide mentorship to team members

Role Description We’re looking for a Cybersecurity Engineer to support the secure deployment and continuous authorization of IronSled, an enterprise Platform as a Service built for federal missions. You’ll join a small, high-visibility team and own the security work that lets IronSled reach production, maintaining the ATO posture, driving vulnerability management, and partnering with cyber stakeholders to keep the platform compliant as it evolves. This is hands-on cyber engineering, not paper compliance. You’ll work alongside platform engineers, ISSOs, and the security team to harden deployments, validate controls, and resolve findings against real systems. If you want to do federal cybersecurity in an environment that ships fast and treats security as part of the product, keep reading. IronSled is LMI’s DevSecOps platform that serves as the central hub for all software development projects. IronSled allows internal and external users to set up development environments with just a few clicks. Responsibilities - Lead Risk Management Framework (RMF) activities for the LIGER deployment, including system categorization, control selection and tailoring, implementation, assessment, and continuous monitoring. - Own and maintain authorization artifacts: System Security Plan (SSP), Security Assessment Plan (SAP), Security Assessment Report (SAR), Plan of Action and Milestones (POA&M), and supporting documentation aligned to DHS requirements. - Coordinate directly with ISSOs, Authorizing Officials, and cyber working groups to advance ATO and continuous authorization activities. - Interpret NIST 800-53 controls in the context of the LIGER platform and translate them into actionable engineering requirements. - Run and review vulnerability scans across CI/CD pipelines and runtime environments, triage findings, and drive remediation through the engineering team. - Validate secure configurations and hardening baselines (e.g., CIS Benchmarks, DISA STIGs) on containers, hosts, and cloud resources. - Partner with platform engineers on cloud and container security in AWS GovCloud, including IAM, network controls, secrets management, logging, and runtime protection. - Develop and maintain security policies, procedures, and standard operating procedures (SOPs) specific to LIGER on customer infrastructure. - Track audit findings, remediation actions, and POA&M items to closure. - Support FedRAMP-aligned control implementation and inheritance where applicable. - Advise senior LIGER and leadership on system risk levels, control effectiveness, and emerging compliance considerations for AI/LLM systems in federal environments. Qualifications - Bachelor’s degree in Cybersecurity, Computer Science, Information Systems, or a related field. - 5+ years of experience designing, implementing, and monitoring cybersecurity solutions in federal environments. - 5+ years of hands-on RMF experience, including ATO development and continuous monitoring against NIST 800-53. - CISSP, CISM, or equivalent senior-level cybersecurity certification. - Experience securing LLM, GenAI, or agentic AI systems, including data handling, prompt and tool-call risk, and model output controls. - Strong working knowledge of cloud security, particularly AWS, with experience in GovCloud or similar high-compliance environments. - Experience with vulnerability management workflows: scanning, triage, remediation tracking, and reporting. - Experience hardening systems against secure baselines such as CIS Benchmarks or DISA STIGs. - Familiarity with secure software development practices: secrets management, access control, auditability, and CI/CD pipeline security. - Strong written communication skills, including the ability to produce ATO artifacts that hold up to assessor and AO review. - Ability to translate compliance requirements into specific engineering work and partner closely with developers. What Will Set You Apart - Direct experience supporting ATO or continuous authorization for systems hosted at DHS, or another DHS component. - Familiarity with DHS 4300A and cybersecurity policies and processes. - FedRAMP readiness or assessment experience (Moderate or High). - Hands-on container and Kubernetes security experience (e.g., EKS, image scanning, admission control, runtime protection). - DevSecOps experience integrating security scanning into GitLab CI/CD pipelines. - Experience with vulnerability management platforms such as Tenable. - Experience with ATO documentation tooling (e.g., Xacta, OpenRMF, or similar). - Familiarity with CISA Binding Operational Directives, Continuous Diagnostics and Mitigation (CDM), or High Value Asset (HVA) program requirements. Salary Information Target salary range: $111,427 - $200,000 The salary range displayed represents the typical salary range for this position and is not a guarantee of compensation. Individual salaries are determined by various factors including, but not limited to location, internal equity, business considerations, client contract requirements, and candidate qualifications, such as education, experience, skills, and security clearances.

• Managing multiple medium to large size system-wide projects involving a variety of information technology platforms • Leading project teams through planning, executing, and controlling activities to meet customer requirements • Monitoring compliance with project management standards • Providing leadership in Information Services or respective departments • Serving as a mentor to new or less experienced project managers