Senior Security Engineer

Citian•Washington, DC

5d•$150,000 - $200,000

About The Position

Citian is a fast-growing, venture-backed SaaS technology company based in Washington, DC, building software for transportation and infrastructure systems. The Senior Security Engineer will work with engineering, data teams, and company leadership to secure products used by public agencies, establish security standards, and support expansion to more states. The role is hands-on: setting requirements, writing infrastructure code, reviewing changes, helping teams remediate issues, and explaining risk and trade-offs to engineers, executives, and customers. The position leads security and compliance for products including crash analytics, asset management, and crash data intake. A key focus is securing the crash data intake product, which processes criminal justice information in AWS GovCloud, and creating repeatable safeguards for each new state. The engineer translates customer contracts and frameworks such as SOC 2 and CJIS into owned controls with verification and current evidence, and supports independent assessments, including assessments against NIST SP 800-53 Moderate when required. The engineer also serves as a technical contact for customer security and compliance teams, oversees vulnerability management, establishes security monitoring and incident response, and develops security standards and checks for engineers and AI coding agents. The job must be performed from within the United States. Access to some customer systems and data requires agency background screening, including fingerprint-based checks, and ongoing security training.

Requirements

Bachelor's degree in Computer Science, Information Security, or a related field, or equivalent experience.
At least 6 years of experience in security, platform, or infrastructure engineering, with a strong security focus in AWS.
Experience securing production systems against defined requirements, including building controls, maintaining evidence, and supporting independent assessments.
Experience with infrastructure as code, such as AWS CDK or Terraform, and core AWS security, including IAM, KMS, networking, and logging.
Application and data security experience, including customer data separation and authorization.
Working knowledge of TypeScript, JavaScript, or Python.
Experience investigating and responding to production security incidents.
Experience working directly with customer security or compliance teams.
Uses AI coding tools in daily work, reviews their output, and keeps sensitive data out of unapproved AI services.
Must perform the job from within the United States; access to some customer systems and data requires agency background screening, including fingerprint-based checks, and ongoing security training.

Nice To Haves

Experience with CJIS, AWS GovCloud, FedRAMP, GovRAMP (formerly StateRAMP), or NIST SP 800-53 assessments, especially for state or local government.
SOC 2 Type 2 experience, including use of compliance tools such as Drata.
Experience protecting personal data in data pipelines, including AI processing.
Experience with identity providers such as Auth0, Okta, or Amazon Cognito.
Experience with transportation or public safety data.
Security certifications such as AWS Security Specialty or CISSP.

Responsibilities

Lead security and compliance across crash analytics, asset management, and crash data intake products; work with engineering and data teams to set requirements, build controls, track fixes, and prepare for audits and assessments.
Secure the crash data intake product in AWS GovCloud, including identity and MFA, encryption and key management, FIPS requirements where applicable, network isolation, logging and alerts, backup and recovery, retention and deletion, and controls on data leaving the environment.
Set and enforce access controls for regulated customer data, including contractual limits on access from outside the United States and through third-party tools.
Translate customer contracts and security frameworks, including SOC 2 and CJIS, into specific controls with owners, checks (automated where possible), and current evidence.
Support independent assessments required by contracts, such as assessments against NIST SP 800-53 Moderate.
Serve as the technical contact for customers' security and compliance teams, in coordination with Customer Success, handling questionnaires, architecture reviews, and audits.
Manage vulnerability discovery and prioritization across infrastructure, code, and dependencies; coordinate remediation, verify fixes, and track exceptions.
Establish security monitoring and incident response, and practice incident response with the engineering on-call team.
Write security standards for engineers and AI coding agents, and incorporate checks into development and deployment processes.
Determine when external support is needed, such as assessors, penetration testers, or managed services, and lead that work.