Cybersecurity Engineer (Expert)
About The Position
Pueo is seeking a Senior Cyber Security Engineer to join its multidisciplinary team onsite in McLean, Virginia. The role focuses on designing and securing air-gapped Kubernetes and OpenShift platforms in classified enclaves. It combines container-platform expertise, federal compliance, CI/CD security automation, and incident response to support disconnected container ecosystems, implement automated security controls, accelerate ATO timelines, and assess platforms supporting mixed-sensitivity workloads in SCIFs. The engineer will design and help implement multi-tenant clusters and secure CI/CD pipelines; manage registry governance, signed images, software bills of materials and provenance, vulnerability gates, and offline patching; and implement admission controls and role-based access. The role also includes tailoring federal controls, generating RMF/ATO evidence, applying container platform STIGs, implementing continuous monitoring and Zero Trust, and supporting incident response and disaster recovery across isolated sites.
Requirements
- Active/current Top Secret security clearance with SCI eligibility; must be able to obtain and maintain a CI poly.
- Bachelor’s degree in a related field and 12 years of experience, or 16 or more years of experience in lieu of a completed degree.
- One of the listed IAT III certifications compliant with DoD 8570.01-M and DoD Directive 8140, such as CASP+ CE, CCNP Security, CISA, CISSP or CISSP Associate, GCED, GCIH, or CCSP.
- Extensive experience with Kubernetes, OpenShift, RKE2, and container registry management in air-gapped and classified environments.
- Deep understanding of CI/CD pipeline architectures, especially in disconnected networks.
- Expertise in federal cybersecurity frameworks and processes, including NIST 800-53, DISA STIGs, RMF, and ATO.
- Familiarity with SAST, DAST, IAST, and IaC security testing tools and automated compliance validation.
- Proven experience enforcing Zero Trust principles, managing PKI, and implementing network segmentation in a classified environment.
- Ability to map pipeline artifacts to RMF/ATO controls and support security operations during incidents.
- Extensive experience in cybersecurity design and architecture.
Nice To Haves
- Active Top Secret security clearance with SCI eligibility and current CI poly.
- Certified Kubernetes Administrator (CKA), Certified Kubernetes Security Specialist (CKS), GIAC Security Essentials Certification (GSEC), Red Hat Certified Specialist in Kubernetes Administration (RHCSA/RHCE), or Certified Application Security Engineer (CASE).
- Experience leading security projects and initiatives.
- Collaborative team player with experience working in mixed technical teams.
Responsibilities
- Design and help implement multi-tenant Kubernetes/OpenShift clusters in disconnected, classified enclaves.
- Manage registry governance, image signing, SBOM and provenance, vulnerability gating, and offline patching.
- Implement admission control and RBAC for multi-tenancy in classified environments.
- Design and secure CI/CD pipelines integrating SAST, DAST, IaC scanning, and automated compliance checks.
- Generate RMF/ATO evidence using OSCAL mappings and eMASS integration, and enforce artifact-promotion gates.
- Tailor NIST 800-53 controls for containerized systems and apply Kubernetes, Docker, and OpenShift DISA STIGs; track exceptions.
- Implement continuous monitoring dashboards using on-premises tools such as Prometheus, Falco, and auditd.
- Implement Zero Trust in Kubernetes using mTLS, service mesh, SPIFFE/SPIRE, and identity propagation across build and runtime layers.
- Manage offline PKI operations with short-lived certificates and air-gapped roots; design east-west segmentation and tamper-evident cross-domain artifact transfer.
- Lead or contribute to security initiatives requiring cross-functional coordination.
- Manage competing priorities and complex stakeholder relationships.
- Architect secure, scalable containerized platforms for mixed-sensitivity workloads in SCIFs.
- Map CI/CD artifacts to RMF/ATO controls and automate evidence generation to accelerate authorization timelines.
- Tailor and reconcile federal compliance requirements across NIST, CNSS, and program-specific directives.
- Operate and troubleshoot Kubernetes clusters in air-gapped enclaves with minimal external support.
- Detect, investigate, and respond to security incidents while maintaining data integrity in classified environments.
- Coordinate development, security, and operations teams to implement secure, compliant practices.
- Design and execute disaster recovery and resilience strategies across isolated sites.
Benefits
- Variety of employee benefits; specific benefits are not listed.
- Annual bonuses, short- and long-term incentives, and program-specific awards may be available as part of total compensation.
Stand Out From the Crowd
Upload your resume and get instant feedback on how well it matches this job.
What This Job Offers
Job Type
Full-time
Career Level
Senior
