Security Standards And Frameworks

Security Standards And Frameworks Engineer Jobs

2 jobs found

1d ago

Principal Product Security Engineer

Navy Federal Credit Union Winchester, VA

Winchester, VA

1d ago

Full time Senior Application Security Application Security Engineering

Apply Now

Job Description

Navy Federal Credit Union is looking for a senior, individual contributor Principal Product Security Engineer to shape how secure software is delivered across the organization. In this onsite role in Winchester, VA, you will define and integrate Secure Software Development Lifecycle (Secure SDLC) practices into Navy Federal’s software delivery workflows, serving as an integration lead between product security expectations and engineering execution.

This position is designed for a partner who can translate security standards and risk expectations into practical engineering requirements, support governance and lifecycle risk decision points, and drive adoption measures that improve developer experience and product security outcomes at scale.

Summary

Principal Product Security Engineer - Secure Development Lifecycle is a senior individual contributor role that defines and integrates Secure SDLC practices into software delivery workflows.
Acts as an integration lead, aligning product security expectations with engineering and technology processes, governance forums, and lifecycle risk decision points.

Responsibilities

Define and mature Secure Software Development Lifecycle practices aligned to Navy Federal software delivery processes, operating models, and secure development practices.
Define and support a pre-production product security scorecard for risk-informed release decisions, communicating product security posture, open risks, exceptions, and required remediation actions to business and technology stakeholders.
Serve as the senior individual contributor integration lead for embedding Secure Development Practice capabilities into engineering workflows, governance forums, and lifecycle activities.
Map product security activities to software delivery processes including intake, planning, architecture review, design, development, testing, release, exception management, and operational handoff.
Establish repeatable process patterns to integrate threat modeling, secure coding, application security testing, software composition analysis, API security, software supply chain security, product integrity testing, and risk-based exception handling.
Identify and reduce redundant reviews, unclear handoffs, late-stage security friction, and legacy process steps that do not align with Navy Federal software delivery practices.
Develop Secure SDLC operating models, workflow diagrams, playbooks, process documentation, RACI models, control integration points, and implementation guidance.
Translate security standards, objectives, and risk expectations into practical engineering requirements and developer-consumable guidance.
Partner with software engineering, architecture, DevSecOps, Information Security, governance, and risk stakeholders to align secure development practices with enterprise delivery processes.
Support integration of secure development expectations into architecture governance, delivery boards, exception processes, and lifecycle risk decision points.
Recommend process improvements that strengthen security outcomes, improve developer experience, increase risk visibility, and enable secure delivery at scale.
Establish adoption and effectiveness measures to demonstrate Secure SDLC maturity, control integration, developer enablement, reduced friction, and improved product security outcomes.
Lead cross-functional working sessions, develop executive-ready recommendations, and influence process decisions across security and engineering stakeholders without direct authority.

Requirements

Bachelor’s degree in information technology, Cybersecurity, Computer Science, Software Engineering, Information Systems, Engineering, or related field, or the equivalent combination of education, training, and experience.
Experience defining, improving, or integrating secure development lifecycle practices into enterprise software delivery processes.
Strong understanding of secure development practices including threat modeling, secure coding, application security testing, software composition analysis, API security, software supply chain security, vulnerability management, and risk-based exception handling.
Extensive hands-on experience translating security requirements, control objectives, or risk expectations into practical engineering processes, workflow guidance, and delivery requirements.
Demonstrated experience developing process documentation, operating models, workflow diagrams, playbooks, standards, RACI models, implementation guidance, or executive-level recommendations.
Strong facilitation, analytical thinking, systems thinking, problem-solving, communication, and stakeholder influence skills.
Ability to operate independently as a senior individual contributor and lead complex cross-functional initiatives without direct reporting authority.

Technologies

Secure Software Development Lifecycle
Threat modeling
Secure coding
Application security testing
Software composition analysis
API security
Software supply chain security
Vulnerability management
DevSecOps
NIST Secure Software Development Framework
OWASP SAMM
OWASP ASVS
OWASP Top 10
BSIMM
ISO 27001
NIST Cybersecurity Framework
Agile
SAFe
DevOps
CI/CD
Product-oriented delivery
Architecture governance
Release management
CISSP
CISM
CSSLP
CCSP
GIAC

Desired Qualifications

Extensive hands-on experience in application security, secure SDLC, software engineering, DevSecOps, enterprise architecture, technology risk, or software delivery governance.
Strong understanding of software delivery practices including Agile, SAFe, DevOps, DevSecOps, CI/CD, product-oriented delivery, architecture governance, and release management.
Advanced degree in Information Technology, Cybersecurity, Computer Science, Software Engineering, Information Systems, Engineering, Business Administration, or related field.
Experience with industry frameworks or models such as NIST Secure Software Development Framework, OWASP SAMM, OWASP ASVS, OWASP Top 10, BSIMM, ISO 27001, NIST Cybersecurity Framework, or similar security and software assurance practices.
CISSP, CISM, CSSLP, CCSP, GIAC, cloud security, architecture, Agile, SAFe, or related professional certifications.

Work Schedule

Monday - Friday, 8:00AM - 4:30PM

Location

Onsite: 141 Security Drive, Winchester, VA 22602

Bank Secrecy Act

Remains cognizant of and adheres to Navy Federal policies and procedures, and regulations pertaining to the Bank Secrecy Act.

View full job page →

1d ago

Information Systems Security Engineer

Amyx, Inc. O'Fallon, IL

O'Fallon, IL

1d ago

Full time Cybersecurity Tools Information Security Information Technology (IT)

Apply Now

Job Description

Amyx, Inc. is seeking Information Systems Security Engineers to support the US Transportation Command (TRANSCOM) Senior Information Security Officer (SISO) contract at Scott Air Force Base, IL.

Responsibilities

Perform risk assessments to determine risk from integrating new systems or capabilities into the USTRANSCOM environment.
Gather supporting data for RMF requirements from other DoD/Federal organizations, vendors, or Internet research as needed.
Conduct risk assessments using NIST SP 800-30 (Guide for Conducting Risk Assessments) and NIST SP 800-160 Vol I and Vol II principles, plus security best practices.
Maintain current ISSE process and procedure documentation and support contract deliverable generation and delivery.
Implement security controls aligned with applicable ICDs, NISP, NIST, and governing government regulations and local facility procedures.
Conduct ongoing vulnerability testing to verify security features and operating controls are functional, effective, and meet government standards.
Coordinate with internal and external customers and/or government security officials to execute security duties and address routine information security matters with employees.
Communicate accurate information to support security activities and stakeholder needs.

Requirements

Minimum 5 years of related experience.
Secret security clearance.
DoD 8570 IAT-II certification.
Proficiency with computer applications and testing tools, including Word, Excel, PowerPoint, DISA STIG Viewer, Nessus, and similar tools.
Experience supporting the certification and accreditation process for information systems, including the ability to write, review, and coordinate system security plans.
Excellent written and verbal communication, including presenting material to senior DoD and non-DoD officials.
Ability to communicate effectively with senior leaders and customers to clearly present technical approaches and findings.

Technologies / Tools

RMF
NIST
DevSecOps
SSH
HBSS
NIST SP 800-30
NIST SP 800-160 Vol I
NIST SP 800-160 Vol II
Word, Excel, PowerPoint
DISA STIG Viewer
Nessus

Desired Skills

BA/BS degree from an accredited university.
Demonstrated knowledge and understanding of the USTRANSCOM mission.
IAM-II or greater certification.

Physical Demands

Sit at a workstation for extended periods; use hands to handle or feel objects/tools/controls; reach with hands and arms; talk and hear.
Ability to work on a desktop or laptop computer for extended periods for reading, reviewing/analyzing information, and producing written recommendations, summaries, and/or reports.
Communicate effectively with others verbally and in writing.
May be required to occasionally lift or move moderate amounts of weight, typically less than 20 pounds.
Regular and predictable attendance is essential.

Benefits

Medical, Dental, and Vision Plans (PPO & HSA options available)
Flexible Spending Accounts (Health Care & Dependent Care FSA)
Health Savings Account (HSA)
401(k) with matching contributions
Roth
Qualified Transportation Expense with matching contributions
Short Term Disability
Long Term Disability
Life and Accidental Death & Dismemberment
Basic & Voluntary Life Insurance
Wellness Program
PTO
11 Holidays
Professional Development Reimbursement

Job Overview

Amyx is seeking several Information Systems Security Engineer (ISSE) personnel to support the US Transportation Command (TRANSCOM) Senior Information Security Officer (SISO) contract at Scott Air Force Base, IL (onsite).
Support USTRANSCOM risk management processes by assessing potential risks, mitigation measures, residual risks, and providing Security Risk Assessment recommendations to the Government.
Research and advise the SISO and other Government staff on recently developed countermeasures to protect command systems from new threats.
Assist in development, implementation, and administration of effective security programs for Government approval.
Provide guidance, cyber alerts, and best practice information to appropriate audiences.

View full job page →

Security Standards And Frameworks Engineer Jobs

Principal Product Security Engineer

Information Systems Security Engineer

Get Security Standards And Frameworks Engineer Jobs alerts