Cybersecurity Engineer

Pueo Business Solutions LLC • McLean, VA

3d • $137,202 - $220,503 • Onsite

About The Position

Pueo is seeking an experienced Cybersecurity Engineer to join its multidisciplinary team onsite in McLean, Virginia. The role focuses on designing and securing air-gapped Kubernetes and OpenShift platforms in classified enclaves, combining container-platform expertise with federal compliance, CI/CD security automation, and incident response. The engineer will help architect disconnected container ecosystems, implement automated security controls, accelerate ATO timelines, and assess platforms supporting mixed-sensitivity workloads in SCIFs.

The position includes designing and helping implement multi-tenant container platforms; governing registries and signed, provenance-tracked artifacts; securing CI/CD pipelines; mapping evidence to RMF/ATO requirements; tailoring federal controls; and implementing Zero Trust across build and runtime environments. The engineer will also operate and troubleshoot air-gapped Kubernetes clusters, respond to security incidents, coordinate across development, security, and operations teams, and develop disaster-recovery and resilience strategies for isolated sites.

Requirements

• Active/current Top Secret security clearance with SCI eligibility; must be able to obtain and maintain a CI poly.
• Bachelor’s degree in computer science, engineering, or a related field and 8 years of experience, or 12 years of experience in lieu of a completed degree.
• Obtain and maintain an IAT III certification compliant with DoD 8570.01-M and DoD Directive 8140, such as CASP+ CE, CCNP Security, CISA, CISSP or CISSP Associate, GCED, GCIH, or CCSP.
• Extensive experience with Kubernetes, OpenShift, RKE2, and container registry management in air-gapped and classified environments.
• Deep understanding of CI/CD pipeline architectures, especially in disconnected networks.
• Expertise in federal cybersecurity frameworks and processes, including NIST 800-53, DISA STIGs, RMF, and ATO.
• Familiarity with security testing tools and automated compliance validation, including SAST, DAST, IAST, and IaC tools.
• Proven experience enforcing Zero Trust principles, managing PKI, and implementing network segmentation in a classified environment.
• Ability to map pipeline artifacts to RMF/ATO controls and support security operations during incidents.
• Extensive experience in cybersecurity design and architecture.

Nice To Haves

• Active Top Secret security clearance with SCI eligibility and current CI poly.
• Active/current IAT III certification compliant with DoD 8570.01-M and DoD Directive 8140, such as CASP+ CE, CCNP Security, CISA, CISSP or CISSP Associate, GCED, GCIH, or CCSP.
• Certifications such as Certified Kubernetes Administrator (CKA), Certified Kubernetes Security Specialist (CKS), GIAC Security Essentials Certification (GSEC), Red Hat Certified Specialist in Kubernetes Administration (RHCSA/RHCE), or Certified Application Security Engineer (CASE).
• Some experience leading security projects and initiatives.
• Team-oriented collaboration skills and experience working in mixed technical teams.

Responsibilities

• Design and help implement multi-tenant Kubernetes/OpenShift clusters in disconnected enclaves, including registry governance, image signing, SBOM and provenance practices, vulnerability gates, offline patching, admission control, and RBAC.
• Help design and secure CI/CD pipelines integrating SAST, DAST, IaC scanning, and automated compliance checks; enforce artifact promotion gates based on signed and provenance-tracked artifacts and passing STIG checks.
• Generate RMF/ATO evidence using OSCAL mappings and eMASS integration, and map CI/CD artifacts to applicable controls to support authorization timelines.
• Tailor NIST 800-53 controls for containerized systems, apply Kubernetes/Docker/OpenShift DISA STIGs, track exceptions, and reconcile federal, CNSS, and program-specific requirements.
• Implement continuous monitoring dashboards using on-premises tools such as Prometheus, Falco, and auditd, and automate evidence generation to reduce ATO lead times.
• Implement Zero Trust in Kubernetes using mTLS, service mesh technologies such as SPIFFE/SPIRE, and identity propagation across build and runtime layers.
• Manage offline PKI operations, including short-lived certificates and air-gapped roots; design east-west segmentation and tamper-evident cross-domain artifact transfer.
• Lead or contribute to security initiatives requiring cross-functional coordination; manage competing priorities and complex stakeholder relationships.
• Architect secure, scalable containerized platforms for mixed-sensitivity workloads in SCIFs.
• Operate and troubleshoot Kubernetes clusters in air-gapped enclaves with minimal external support.
• Detect, investigate, and respond to security incidents while maintaining data integrity in classified environments.
• Coordinate development, security, and operations teams to implement secure, compliant practices.
• Design and execute disaster-recovery and resilience strategies across isolated sites.

Benefits

• Variety of benefits to employees; specific benefits are not listed.
• Annual bonuses, short- and long-term incentives, and program-specific awards may be available as part of total compensation.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior