Cybersecurity Engineer

Pueo Business Solutions LLC • McLean, VA

3d • $131,259 - $210,952 • Onsite

About The Position

Pueo is seeking an experienced Cybersecurity Engineer to join its multidisciplinary team onsite in McLean, Virginia. The role focuses on designing and securing air-gapped Kubernetes and OpenShift platforms in classified enclaves, combining container-platform expertise with federal compliance, CI/CD security automation, and incident response. The engineer will help architect disconnected container ecosystems, implement automated security controls, accelerate ATO timelines, and assess platforms that support mixed-sensitivity workloads in SCIFs.

The position includes designing and supporting multi-tenant container clusters in disconnected environments; governing registries, signed images, software bills of materials, provenance, vulnerability gates, and offline patching; and implementing admission controls and role-based access control. It also involves securing CI/CD pipelines, generating RMF/ATO evidence, tailoring federal controls, applying STIGs, and establishing continuous monitoring. The engineer will implement Zero Trust practices across build and runtime environments, manage offline PKI, support incident response, coordinate across development, security, and operations teams, and develop disaster recovery and resilience strategies for isolated sites.

Requirements

• Active/current Top Secret security clearance with SCI eligibility; must be able to obtain and maintain a CI poly.
• Master’s degree in computer science, engineering, or a related field and 12 years of experience, or an additional six years of experience (18 years total) in lieu of a completed degree.
• Obtain and maintain an IAT III certification compliant with DoD 8570.01-M and DoD Directive 8140, such as CASP+ CE, CCNP Security, CISA, CISSP (or Associate), GCED, GCIH, or CCSP.
• Extensive experience with Kubernetes, OpenShift, RKE2, and container registry management in air-gapped and classified environments.
• Deep understanding of CI/CD pipeline architectures, especially in disconnected networks.
• Expertise in federal cybersecurity frameworks, including NIST 800-53, DISA STIGs, RMF, and ATO processes.
• Familiarity with security testing tools (SAST, DAST, IAST, and IaC) and automated compliance validation.
• Proven track record enforcing Zero Trust principles, PKI management, and network segmentation in a classified environment.
• Strong ability to map pipeline artifacts to RMF/ATO controls and support security operations during incidents.
• Extensive experience in cybersecurity design and architecture.

Nice To Haves

• Active Top Secret clearance with SCI eligibility and current CI poly.
• Current IAT III certification compliant with DoD 8570.01-M and DoD Directive 8140, such as CASP+ CE, CCNP Security, CISA, CISSP (or Associate), GCED, GCIH, or CCSP.
• Relevant certifications such as Certified Kubernetes Administrator (CKA), Certified Kubernetes Security Specialist (CKS), GIAC Security Essentials Certification (GSEC), Red Hat Certified Specialist in Kubernetes Administration (RHCSA/RHCE), or Certified Application Security Engineer (CASE).
• Experience leading security projects and initiatives.
• Team-player and collaborative qualities, with experience working in mixed technical teams.

Responsibilities

• Design and aid implementation of multi-tenant Kubernetes/OpenShift clusters in disconnected enclaves.
• Manage registry governance, image signing, SBOM/provenance, vulnerability gating, and offline patching.
• Implement admission control using OPA Gatekeeper or Kyverno and RBAC for multi-tenancy in classified environments.
• Aid design and secure CI/CD pipelines integrating SAST, DAST, IaC scanning, and automated compliance checks.
• Generate RMF/ATO evidence through OSCAL mappings and eMASS integration.
• Enforce promotion gates requiring signed and provenanced artifacts and passing STIG checks.
• Tailor NIST 800-53 controls for containerized systems using shared responsibility matrices; apply Kubernetes, Docker, and OpenShift DISA STIGs and track exceptions.
• Implement continuous monitoring dashboards using on-premises tools such as Prometheus, Falco, and auditd, and reduce ATO lead times through automation and evidence generation.
• Implement Zero Trust in Kubernetes using mTLS, service mesh (SPIFFE/SPIRE), and identity propagation across build and runtime layers.
• Manage offline PKI operations with short-lived certificates and air-gapped roots; design east-west segmentation and cross-domain artifact transfer with tamper-evident controls.
• Lead or contribute to security initiatives requiring cross-functional coordination and manage competing priorities and complex stakeholder relationships.
• Architect secure, scalable containerized platforms for mixed-sensitivity workloads in SCIFs.
• Map CI/CD artifacts to RMF/ATO controls and accelerate authorization timelines through automation.
• Tailor and reconcile federal compliance requirements across NIST, CNSS, and program-specific directives.
• Operate and troubleshoot Kubernetes clusters in air-gapped enclaves with minimal external support.
• Detect, investigate, and respond to security incidents while maintaining data integrity in classified environments.
• Coordinate development, security, and operations teams to implement secure, compliant practices.
• Design and execute disaster recovery and resilience strategies across isolated sites.

Benefits

• Variety of employee benefits; specific benefits are not listed.
• Annual bonuses, short- and long-term incentives, and program-specific awards may be offered.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior