Security Standards & Frameworks

Security Standards & Frameworks Engineer Jobs

2 jobs found

Today

Security Engineer - GRC Federal Frameworks

SpaceXSI Washington, DC

Washington, DC

Today

$100k - $198k/yr Full time Cloud Cmmc Controls Continuous Monitoring

Apply Now

Job Description

SpaceXSI is seeking an experienced Governance, Risk, and Compliance (GRC) professional to help scale its security compliance program. This onsite role in Washington, DC focuses on NIST Risk Management Framework (RMF), FedRAMP, and Impact Level 4/5 authorization processes, with an emphasis on continuous monitoring artifacts and close partnership with engineering teams to implement and validate controls.

Responsibilities

Execute security compliance implementation and audits, including DoD Cloud Computing SRG IL5/IL6, FedRAMP Class D. (Rev. 5 / CR2026), NIST 800-53, NIST 800-171/CMMC, and Risk Management Framework activities.
Oversee audits, certifications, third-party assessments, and vulnerability management to support sustained compliance and operational credibility.
Design and implement risk mitigation strategies, including monitoring systems, contingency planning, vulnerability scans, Plan of Action and Milestones (POAMs), and STIGs.
Ensure security configurations, practices, and procedures are implemented, monitored, and maintained across the project lifecycle.
Act as a liaison between system owners, security personnel, and cross-functional teams to support communication, collaboration, and control implementation.
Lead Risk Management Assessment and Authorization (A& A) processes, cloud system risk assessments, compliance reviews for new products, changes, and features, and process improvements.
Perform regular risk assessments, scenario analyses, and proactive evaluations of emerging threats, certifications, requirements, and technologies in the AI landscape.
Serve as a subject matter expert on risk, compliance, and cybersecurity matters; translate business and technical risk for leadership.
Create and present recurring reports on GRC performance, risks, and compliance status for senior leadership and stakeholders.

Required Qualifications

Bachelor’s degree in computer science, Information Security, Cybersecurity, or an engineering/STEM field.
3+ years of experience in governance, risk management, compliance, or technology audit roles.
At least 1 year of experience with FedRAMP/IL5 compliance, vulnerability management, and continuous monitoring.
Experience implementing and maintaining security compliance frameworks and cloud security controls.
Expert-level knowledge in at least one domain: DoD Cloud Computing SRG IL5/IL6, FedRAMP Class D., and/or NIST 800-171/CMMC.

Relevant Technologies

NIST Risk Management Framework (RMF)
FedRAMP
Impact Level 4/5 (IL4/IL5)
DoD Cloud Computing SRG IL5/IL6
FedRAMP Class D. (Rev. 5 / CR2026)
NIST 800-53
NIST 800-171/CMMC
Plan of Action and Milestones (POAMs)
STIGs
Risk Management Assessment and Authorization (A& A)
Continuous Monitoring

Preferred Skills and Experience

5+ years of security compliance or technology audit-related experience.
Hands-on experience implementing technical controls (e.g., IAM, logging and monitoring, encryption, infrastructure hardening) and integrating compliance checks into CI/CD pipelines.
Strong analytical, problem-solving, organizational, and project management capabilities, including balancing innovation, oversight, and delivery from concept to launch.
Ability to evaluate control objectives with IT configurations.
Hands-on experience implementing technical controls, not solely assessing them.
Experience in the tech or AI industry, especially with startups or innovative organizations.
Experience with CI/CD pipelines and DevSecOps practices, including compliance-as-code (e.g., policy-as-code frameworks like OPA), automated control validation, and continuous compliance monitoring integrated into the deployment pipeline.
Excellent communication and stakeholder management skills, including translating risks to leadership and influencing cross-functional teams.
Experience with commercial compliance programs (e.g., ISO 27001, ISO 42001, SOC 2, NIST CSF, NIST 800-53, or similar) is a plus.

Benefits

Equity
Comprehensive medical, vision, and dental coverage
Access to a 401(k) retirement plan
Short and long-term disability insurance
Life insurance
Various other discounts and perks

Compensation and Location

Location: Washington, DC (onsite)
Salary: USD 100,000 to 198,000 per year

ITAR Requirements

To conform to U.S. Government export regulations, applicant must be a (i) U.S. citizen or national, (ii) U.S. lawful, permanent resident (aka green card holder), (iii) Refugee under 8 U.S.C. § 1157, or (iv) Asylee under 8 U.S.C. § 1158, or be eligible to obtain the required authorizations from the U.S. Department of State.

View full job page →

14d ago

Application Security Engineer

Purpose Brands Boca Raton, FL

Boca Raton, FL

14d ago

Full time Application Security Application Security Engineering Application Security Testing

Apply Now

Job Description

Purpose Brands is hiring an Application Security Engineer to expand application security capabilities within a DevSecOps delivery model.

Responsibilities

Embed application security practices across the full SDLC, covering design, deployment, and ongoing maintenance
Run application security assessments using SAST, DAST, and SCA
Develop and maintain threat models for critical applications and systems, working with engineering teams to identify threats, evaluate risk, and drive remediation
Advance secure coding practices and contribute to secure development standards aligned with OWASP and industry best practices
Collaborate with engineering and DevOps teams to integrate security tooling into CI/CD pipelines for automated, repeatable security testing
Review and manage vulnerability results from tools such as GitHub Advanced Security, Syft, Clair, Qualys, and similar platforms
Tune security tooling to reduce false positives and improve signal quality for development teams
Support security automation adoption to improve consistency, efficiency, and scalability across application environments
Help secure applications deployed on AWS and Azure, including workloads on IaaS, PaaS, and container-based platforms
Identify and assess risks to confidentiality, integrity, and availability of application data in cloud environments
Partner with cloud and platform security engineers to align application security controls with broader cloud security architecture
Own and curate security controls within Cloud Engineering and Platform Engineering spaces, aligned to NIST CSF, CIS Benchmarks, and CSA CCM
Triage, prioritize, and track vulnerability remediation based on risk and business impact
Assist with security investigations tied to application vulnerabilities or security events
Participate in periodic reviews of application security controls to validate effectiveness and compliance with organizational standards
Serve as a security partner to engineering teams by providing guidance, education, and actionable recommendations
Contribute to continuous improvement of application security processes, standards, and metrics
Support governance, risk management, and compliance initiatives related to application security

Requirements

Bachelor’s degree in Computer Science, Information Systems, Engineering, or a related field
3–5 years of experience in application security, security engineering, or software engineering with strong security focus
Hands-on experience performing code reviews and application security testing across modern languages, frameworks, and APIs
Experience with application security tooling including SAST, DAST, and dependency scanning (for example, GitHub Dependabot or similar)
Strong knowledge of OWASP Top 10, secure coding principles, authentication/authorization, and API security
Practical experience supporting applications running in AWS and/or Azure
Familiarity with CI/CD, DevOps workflows, and DevSecOps concepts
Ability to communicate security risk and remediation guidance clearly to developers and non-security stakeholders
Strong analytical skills with the ability to balance security risk with delivery velocity

Technologies

AWS, Azure, IaaS, PaaS, container-based platforms
SAST, DAST, SCA
GitHub Advanced Security, Syft, Clair, Qualys
OWASP Top 10, OWASP, GitHub Dependabot
CI/CD pipelines, DevOps, DevSecOps
NIST CSF, CIS Benchmarks, CSA CCM

Benefits

Medical, Dental and Vision Coverage
Hybrid Work Environment
Life and Disability Insurance
Unlimited Time off + Paid Holidays
Flexible Friday's between Memorial Day and Labor Day
401(K) Savings Plan Matching at 4%
10 Coaching and Therapy sessions
Mental Health Benefits
Brand Discounts & Reimbursements
In-house workout facilities
Professional Development Opportunities
Team Building, Employee Engagement Activities & so much more

Preferred Certifications

Security+, CSSLP, GWAPT, GWEB, CEH, GPEN or other application security-focused certifications

Work Schedule

Hybrid work model for employees at Boca Raton (FL), Woodbury (MN), and Seattle (WA) offices
Remote optional: Fridays
On-site days: Mondays, Tuesdays, Wednesdays and Thursdays

Location: Boca Raton, FL (hybrid)

View full job page →

Security Standards & Frameworks Engineer Jobs

Security Engineer - GRC Federal Frameworks

Application Security Engineer

Get Security Standards & Frameworks Engineer Jobs alerts