Cybersecurity Engineer (Expert)

Pueo Business Solutions LLC is seeking a Senior Cybersecurity Engineer to design and secure air-gapped Kubernetes and OpenShift platforms deployed in classified enclaves. The role focuses on CI/CD security automation, federal compliance artifacts for authorization, Zero Trust implementation, and incident response operations in SCIF environments.

Location

McLean, VA (onsite)

Compensation

USD 147,742 - 167,888 per year

Summary

The Cybersecurity Engineer (Expert) will support disconnected container ecosystems by implementing automated security controls, conducting platform assessments for mixed-sensitivity workloads, and producing evidence aligned to federal processes. Responsibilities include integrating NIST 800-53 controls, DISA STIGs, and RMF/ATO requirements, while enabling identity-driven access and operational monitoring in isolated environments.

Key Responsibilities

• Design and support implementation of multi-tenant Kubernetes/OpenShift clusters in disconnected enclaves.
• Manage container registry governance, including image signing, SBOM/provenance, vulnerability gating, and offline patching.
• Implement admission control using OPA Gatekeeper and Kyverno, along with RBAC for multi-tenancy in classified environments.
• Support CI/CD pipeline design that integrates SAST, DAST, IaC scanning, and automated compliance checks.
• Generate RMF/ATO evidence using OSCAL mappings and integrate with eMASS.
• Enforce promotion gates requiring signed/provenanced artifacts and passing STIG checks.
• Tailor NIST 800-53 controls for containerized systems using shared responsibility matrices.
• Apply Kubernetes/Docker/OpenShift DISA STIGs and track and manage exceptions.
• Implement continuous monitoring using CONMON dashboards supported by on-prem tools such as Prometheus, Falco, and auditd.
• Reduce ATO lead times through automation and evidence generation.
• Implement Zero Trust in Kubernetes using mTLS, service mesh components (SPIFFE/SPIRE), and identity propagation across build and runtime layers.
• Manage offline PKI operations with short-lived certificates and air-gapped roots.
• Design east-west segmentation and cross-domain artifact transfer with tamper-evident controls.
• Lead or contribute to security initiatives requiring cross-functional coordination.
• Architect secure, scalable containerized platforms for mixed-sensitivity workloads in SCIFs.
• Map CI/CD artifacts to RMF/ATO controls and accelerate authorization timelines through automation.
• Tailor and reconcile federal compliance requirements across NIST, CNSS, and program-specific directives.
• Operate and troubleshoot Kubernetes clusters in air-gapped enclaves with minimal external support.
• Detect, investigate, and respond to security incidents while maintaining data integrity in classified environments.
• Coordinate between development, security, and operations teams to implement secure, compliant practices.
• Design and execute disaster recovery and resilience strategies across isolated sites.

Required Qualifications

• Active/current Top Secret security clearance with SCI eligibility.
• Ability to obtain and maintain a CI poly.
• Bachelor’s degree in related field and 12 years of experience, or an additional 4 years of experience in lieu of a completed degree for a total of 16+ years.
• One of the following IAT III certifications in compliance with DoD 8570.01-M and DoD Directive 8140 (e.g., CASP+ CE, CCNP Security, CISA, CISSP (or Associate), GCED, GCIH, CCSP).
• Extensive experience working with Kubernetes, OpenShift, RKE2, and container registry management in air-gapped and classified environments.
• Deep understanding of CI/CD pipeline architectures in disconnected networks.
• Expertise in federal cybersecurity frameworks, including NIST 800-53, DISA STIGs, RMF, and ATO processes.
• Familiarity with security testing tools including SAST, DAST, IAST, IaC and automated compliance validation.
• Proven experience enforcing Zero Trust, PKI management, and network segmentation in a classified environment.
• Strong ability to map pipeline artifacts to RMF/ATO controls and support security operations during incidents.
• Extensive experience in cybersecurity design and architecture.

Technologies

• Kubernetes, OpenShift, RKE2
• Container registry management
• OPA Gatekeeper, Kyverno
• CI/CD pipelines
• SAST, DAST, IaC
• OSCAL, eMASS
• NIST 800-53, DISA STIGs, RMF, ATO
• CONMON, Prometheus, Falco, auditd
• mTLS, SPIFFE, SPIRE
• PKI
• SPIFFE/SPIRE service mesh
• Docker
• CNSS

Desired Qualifications

• Active Top Secret security clearance with SCI eligibility and current CI poly.
• Relevant certifications such as CKA, CKS, GSEC, RHCSA/RHCE, or CASE.
• Some experience leading security projects and initiatives.
• Team-player with collaboration experience in mixed technical teams.