Senior Engineer, Product Security

Forterra • Clarksburg, MD

1d • Hybrid

About The Position

Forterra is seeking a hands-on senior individual contributor to own product security end-to-end for one or more programs. The role serves as the program’s security authority for both engineering teams and government cyber or program offices, owning the Risk Management Framework (RMF) and Authority to Operate (ATO) lifecycle and shaping secure architecture across hardware and software. The engineer sets security direction, defines controls and requirements, explains threat and mission rationale, and provides implementable guidance. For functions built by other teams, the role owns solutioning and verifies implementation. The work includes securing embedded and autonomous systems operating on air-gapped, offline, and intermittently connected networks, and carrying the security case from threat model through signed ATO. The position reports to the Product Security Lead.

The role owns program security documentation, evidence, authorization cases, and government-facing reviews; drives security requirements through systems-engineering processes; and guides secure design and implementation across engineering, systems, safety, test, and DevOps. It also addresses threat modeling, STIG applicability, monitoring and detection, secure updates, vulnerability management, software supply-chain security, SBOMs, and secure SDLC practices. Engineering teams handle hands-on hardening, while this role provides security expertise, translates requirements, and verifies implementation.

The position is hybrid in Clarksburg, Maryland, with three days per week onsite and two days remote. The stated U.S. salary range is $145,000–$175,000. Forterra says equity is included in most full-time, high-demand roles and describes a benefits package for full-time employees.

Requirements

• At least 5 years of security engineering or closely related experience, or equivalent demonstrated skill; must have the depth to be the security decision-maker on a program.
• Bachelor’s degree in Computer Science, Computer Engineering, Information Security, Electrical Engineering, or a related field, or proof of exceptional skill in lieu of a degree.
• Must be a U.S. Person as defined under ITAR and eligible to obtain a U.S. security clearance.
• Hands-on RMF/ATO experience and knowledge of every step of the ATO process, with readiness to act as the sole subject-matter expert internally and with government offices.
• Practical knowledge of NIST 800-37, NIST 800-53, NIST 800-171, and DISA STIGs; familiarity with eMASS artifact requirements, formats, and review cycles.
• Ability to evaluate, tailor, and defend STIG applicability and translate STIG and control requirements into clear implementation or mitigation guidance for engineers.
• Demonstrated depth in both hardware and software security, with a record of identifying and mitigating high-impact vulnerabilities; deep expertise in one domain and solid working competence in the other.
• Ability to write clear security requirements and explain both the rationale and implementation to software and systems engineers.
• Experience with software supply-chain risk management and SBOMs, and fluency in secure SDLC practices such as SAST/DAST, code review, and CI/CD.
• Systems-engineering fluency, including requirements, design reviews, and traceability.
• Working knowledge of FIPS 140-3 and cryptographic module validation, and of applying validated cryptography, TPM/HSM-backed key management, secure boot, and signed firmware to embedded and mission systems.
• Demonstrated ability to work through ambiguity and learn new technologies quickly.

Nice To Haves

• Owned a full ATO package end-to-end as the responsible engineer.
• Familiarity with CMMC.
• Familiarity with ISO/SAE 21434 and IEC 62443 and judgment in applying them where DoD standards and requirements fall short.
• Experience securing disconnected, embedded, or industrial systems.
• CISSP or a similar security certification.
• Offensive-security depth, including disassembly and reverse engineering, fuzzing, and common exploit methodologies.
• Hands-on depth in one or more of C, C++, Python, ARM, x86, or cryptography.

Responsibilities

• Own the RMF and ATO lifecycle end-to-end for assigned programs, including control selection and tailoring, implementation coordination with engineering, and POA&M management.
• Serve as the security subject-matter expert and point of contact for government cyber or program offices; own security documentation, evidence, authorization cases, and required reviews.
• Set program security architecture and direction by defining controls, proposing solutions, and writing requirements for engineering implementation.
• Drive secure-by-design practices across hardware and software, including systems designed for air-gapped, offline, and disconnected operation.
• Define, document, and trace security requirements through systems-engineering processes, requirements and design reviews, and verification and validation.
• Lead threat modeling for autonomy, embedded, and command-and-control systems, and drive risk assessments that balance mitigations with mission needs.
• Advise engineering on STIG requirements, recommend implementation and mitigation approaches, and evaluate, tailor, and defend STIG applicability with customers.
• Own solutioning and verify implementation of security monitoring, logging, and detection; signed, atomic, recoverable firmware and OS updates; and CVE and vulnerability management.
• Partner on software supply-chain security, SBOMs, and secure SDLC practices, including SAST/DAST, code review, and CI/CD, supporting progress toward a secure DevSecOps pipeline.
• Audit embedded and application code for vulnerabilities and drive remediation with internal teams and vendors.
• Collaborate with systems, safety, test, and DevOps teams to meet product- and program-level security needs.

Benefits

• Equity is included in most full-time, high-demand roles.
• Three premium healthcare plan options, including an HSA-eligible plan; Forterra covers 80% of plan premiums for employees and dependents.
• Basic Life/AD&D and short- and long-term disability plans fully covered by Forterra, with the option to purchase additional life insurance for employees and dependents.
• Company holiday calendar that includes a winter break in December.
• 20 days of PTO accrued per year.
• At least 7 weeks of fully paid parental leave for birth or adoption.
• $9,000 annual tuition reimbursement or professional development stipend.
• 401(k) plan with traditional, Roth, and after-tax deferral options and company match up to 4%.
• Stocked beverage refrigerators.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior