Senior Engineer, Product Security

Forterra • Clarksburg, MD

1d • $145,000 - $175,000 • Hybrid

About The Position

Forterra is seeking a hands-on senior individual contributor to own product security for one or more programs. The role is the program’s security authority, responsible for both the security architecture and the Risk Management Framework (RMF) and Authority to Operate (ATO) lifecycle. The engineer will shape secure architecture for hardware and software, propose controls and solutions, write requirements, and direct and verify security implementation. The work includes systems operating in air-gapped, offline, and intermittently connected environments. The position reports to the Product Security Lead and owns the security case from threat modeling through signed ATO, serving as the point of contact for government cyber or program offices.

The role calls for practical security judgment and close collaboration with engineering, systems, safety, test, and DevOps teams. The engineer translates threats and controls into mission-relevant, implementable guidance, manages authorization documentation and evidence, and drives security improvements across the program. Engineering teams perform hands-on hardening; this role provides the expertise, requirements, solutioning, and verification needed to support secure and authorized autonomous platforms.

Requirements

• At least 5 years of security engineering or closely related experience, with the depth to make program-level security decisions; equivalent demonstrated skill may substitute for exact tenure.
• A BS in Computer Science, Computer Engineering, Information Security, Electrical Engineering, or a related field, or proof of exceptional skill in lieu of a degree.
• Must be a U.S. Person as defined under ITAR and eligible to obtain a U.S. security clearance.
• Hands-on RMF/ATO experience and knowledge of every step of the ATO process, with readiness to serve as the sole ATO subject-matter expert internally and with government offices.
• Practical command of NIST 800-37, NIST 800-53, NIST 800-171, and DISA STIGs; familiarity with eMASS artifact requirements, formats, and review cycles.
• Ability to evaluate, tailor, and defend STIG applicability and translate STIG and control requirements into clear implementation or mitigation guidance.
• Demonstrated depth in hardware and software security and a track record of identifying and mitigating high-impact vulnerabilities; deep expertise in one domain and solid working competence in the other.
• Ability to write clear security requirements and communicate both the rationale and implementation approach to software and systems engineers.
• Experience with software supply-chain risk management and SBOMs, and fluency in secure SDLC practices such as SAST/DAST, code review, and CI/CD.
• Systems-engineering fluency, including comfort with requirements, design reviews, and traceability.
• Working knowledge of FIPS 140-3 and cryptographic module validation, and of validated cryptography, TPM/HSM-backed key management, secure boot, and signed firmware in embedded and mission systems.
• Demonstrated ability to work through ambiguity and learn new technologies quickly.

Nice To Haves

• Experience owning a full ATO package end-to-end as the responsible engineer.
• Familiarity with CMMC.
• Familiarity with commercial cybersecurity-engineering standards such as ISO/SAE 21434 and IEC 62443, with judgment to apply them where DoD standards and requirements fall short.
• Experience securing disconnected, embedded, or industrial systems.
• CISSP or similar security certification.
• Offensive-security depth, including disassembly and reverse engineering, fuzzing, and common exploit methodologies.
• Hands-on depth in one or more of C, C++, Python, ARM, x86, or cryptography.

Responsibilities

• Own the RMF and ATO lifecycle for assigned programs, including control selection and tailoring, implementation coordination, POA&M management, security documentation, evidence, and the authorization case.
• Serve as the security subject-matter expert and point of contact for government cyber or program offices, delivering authorization materials in required formats and review cycles.
• Own the program’s security architecture by defining controls, proposing solutions, writing requirements, and directing secure-by-design improvements across hardware and software.
• Define, document, and trace security requirements through systems-engineering processes, including requirements and design reviews and verification and validation.
• Lead threat modeling for autonomy, embedded, and command-and-control systems, and conduct risk assessments that weigh mitigations against mission needs.
• Serve as the STIG subject-matter expert: explain requirements to engineering, recommend implementation or mitigation approaches, and evaluate, tailor, and defend STIG applicability with customers.
• Own solutioning and verify implementation of security monitoring, logging, and detection; secure update strategies; and CVE and vulnerability management.
• Partner on software supply-chain security, SBOMs, and secure SDLC practices, including SAST/DAST, code review, and CI/CD, and help advance a security-focused DevSecOps pipeline.
• Audit embedded and application code for vulnerabilities and drive remediation with internal teams and vendors.
• Collaborate with systems, safety, test, and DevOps teams to address product- and program-level security needs.
• Communicate the threat rationale and mission purpose behind security controls, as well as actionable implementation guidance for engineers.

Benefits

• Competitive benefits for full-time employees.
• Three premium healthcare plan options, including an HSA-eligible plan; Forterra covers 80% of plan premiums for employees and dependents.
• Basic life/AD&D and short- and long-term disability insurance plans fully covered by Forterra, with the option to purchase additional life insurance for employees and dependents.
• Company holiday calendar, including a winter break in December.
• 20 days of PTO accrued per year.
• At least 7 weeks of fully paid parental leave for birth or adoption.
• $9,000 annual tuition reimbursement or professional development stipend.
• 401(k) plan with traditional, Roth, and after-tax deferral options and a company match up to 4%.
• Equity is included in most full-time, high-demand roles.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior