Government Cloud Security Engineer

SpaceXSI•Washington, DC

19h•$100,000 - $198,000

About The Position

SpaceXSI is seeking a hands-on Government Cloud Security Engineer to design, implement, and maintain security controls across federal environments, including hybrid and multi-cloud scenarios. The role focuses on strengthening security posture, protecting critical workloads, and embedding security throughout the development lifecycle in collaboration with engineering, DevOps, and compliance teams. The engineer will use security tools to detect threats and respond to incidents, align environments with industry standards and regulations, and achieve and maintain compliance with government regulations such as FedRAMP and CMMC.

Requirements

Active U.S. security clearance, such as Secret or Top Secret, or eligibility to obtain one.
At least 3 years of hands-on experience in cloud security, cybersecurity, DevSecOps, or infrastructure engineering with a security focus.

Nice To Haves

Microsoft Certified: Azure Security Engineer Associate (AZ-500), Cybersecurity Architect (SC-100), or other relevant certifications such as CISSP, CCSP, AWS Security Specialty, or GIAC certifications (e.g., GCLD or GCIH).
Hands-on experience with Azure security services (Defender, Sentinel, Entra ID, Azure Policy, Key Vault, and Purview) and on-premises Linux, Kubernetes, and network infrastructure (Palo Alto, Cisco, and Juniper).
Experience with detection and response engineering and SOC operations.
Knowledge of container and Kubernetes security, software supply chain security (image signing and hardened base images), or AI/ML workload protection.
Experience supporting FedRAMP High or DoD IL5/IL6 authorizations, including continuous monitoring and assessor interactions.
Hands-on expertise building and maintaining secure infrastructure from the ground up in cloud or on-premises environments.
Proficiency in scripting and automation using PowerShell, Azure CLI, Bicep/ARM templates, or Terraform.
Strong understanding of identity federation, Zero Trust principles, encryption, network security, and vulnerability management.
Familiarity with compliance frameworks and regulatory requirements, including NIST, CMMC, and STIGs.
Excellent problem-solving, analytical, and communication skills.
Strong verbal and written communication skills and the ability to stay composed under pressure.

Responsibilities

Design, implement, and manage security architecture for federal and DoD deployments across cloud and on-premises environments, aligned with FedRAMP High, DoD IL5/IL6, and NIST SP 800-53 controls.
Implement and operate security tooling and services, including SIEM and log pipelines, EDR, vulnerability scanners, container runtime security, and policy-as-code enforcement.
Build secure containerized, Kubernetes-managed environments using Zero Trust principles.
Secure Linux hosts, Kubernetes clusters, virtualization, and databases, including PKI and TLS, SSH and bastion access, and OS-level auditing.
Design and enforce identity and access management, including SSO and federation, phishing-resistant MFA, RBAC, just-in-time privileged access, and periodic access reviews.
Partner with network teams to secure firewalls, VPN and IPsec, DNS, load balancers and reverse proxies, VLAN and subnet segmentation, and routing and switching ACLs.
Protect data through encryption at rest and in transit, including envelope encryption and key management.
Harden operating systems, network devices, databases, and container platforms against DISA STIGs and CIS Benchmarks, and run credentialed vulnerability and compliance scanning to maintain compliance.
Perform detection, threat hunting, incident response, and root cause analysis in collaboration with the SOC; maintain and exercise the incident response plan and meet federal incident reporting requirements.
Own continuous monitoring end to end, including monthly vulnerability scanning and reporting, deviation requests, and driving POA&M items through remediation and closure.
Support ATO packages and assessments, including System Security Plan and control implementation documentation, 3PAO and DISA assessor evidence requests, and significant change requests.
Partner with developers and architects to establish DevSecOps practices, including secure CI/CD pipelines, secure defaults, and security reviews of Infrastructure as Code, container images, and Kubernetes deployments before release.