Sr. Security Engineer
About The Position
Istari Digital is seeking a Senior Security Engineer to lead and advance the security tooling used to test and validate software against compliance and cybersecurity standards. The role ensures the toolchain is consistently enforced, trustworthy, and continuously improved as products, customers, and regulatory requirements expand. The engineer will be an early contributor to the design and implementation of the company’s application security and security operations functions. The Senior Security Engineer will serve as the technical authority for configuring, tuning, and enforcing security checks throughout the software development lifecycle. This includes translating compliance and Risk Management Framework (RMF) requirements into automated, risk-based controls that provide engineers with timely, actionable feedback. The role applies AI-based automation while preserving clear human review for flagged risks. The position will also help implement automated and manual penetration testing and other security testing across deployment environments, and mature security operations through faster, more automated incident response and incident management. It supports regulated and security-sensitive environments, including systems hosted for Government customers, and works closely with engineering, product, and cybersecurity leadership.
Requirements
- At least 7 years of experience in DevSecOps, application security, security operations and incident response, and general security engineering, including at least 3 years owning security tooling in CI/CD pipelines.
- Deep hands-on experience configuring, tuning, and enforcing SAST, SCA, secrets detection, and container scanning tools in production pipelines, including risk-based gates, vulnerability thresholds, and exception processes.
- Demonstrated experience mapping security tooling and pipeline controls to NIST SP 800-53, NIST SP 800-171, or RMF requirements and producing evidence for assessments or authorizations.
- Track record of evaluating, selecting, or evolving security tooling and influencing engineering teams without direct authority.
- Scripting or automation experience in Python, Bash, or similar.
- Security+ or an equivalent DoD 8140 qualifying certification, or ability to obtain one within 2 months of hire.
- U.S. citizen residing and working in the U.S.
Nice To Haves
- Familiarity with tools such as GitHub, Argo CD, JFrog, and Snyk.
- Experience in DoD software factory or Government DevSecOps environments, such as Platform One, Iron Bank, or Big Bang.
- Experience supporting ATO efforts, including control assessment and POA&M management.
- Experience with software supply-chain integrity and policy-as-code practices, such as artifact signing, signature verification, SBOMs, Open Policy Agent (OPA), or Kyverno.
- Experience applying AI and LLM tools to security engineering, such as AI-assisted triage, code review, or remediation.
- Experience with penetration-testing tools, processes, and strategies.
- Familiarity with cloud and container environments where pipelines run and are deployed, such as GitHub, Docker, Kubernetes, and AWS.
- Advanced certifications such as CISSP, SecurityX (CASP+), or GIAC (GSSP, GCSA, or similar).
- Active security clearance; Top Secret is highly desired.
Responsibilities
- Own and evolve the security toolchain, including SAST, SCA, secrets detection, container scanning, and artifact signing.
- Assess tooling effectiveness and coverage, identify gaps, and lead improvements, consolidation, or replacement as needs evolve.
- Develop automated and manual penetration-testing capabilities with rapid feedback loops into engineering.
- Help mature the company’s security operations, incident response, and incident management capabilities.
- Define the long-term roadmap for security tooling and processes with Cybersecurity and Engineering leadership.
- Translate NIST SP 800-53, NIST SP 800-171, and RMF requirements into enforceable pipeline gates, thresholds, and policies.
- Maintain risk-based pass/fail criteria that balance security assurance and delivery speed while minimizing false positives.
- Ensure tooling outputs provide assessor-ready evidence for authorizations, continuous monitoring, and audits.
- Own the exception and manual-review process for findings that fail automated checks, ensuring decisions are documented and traceable.
- Protect the integrity and consistency of security results through artifact signing, signature verification before deployment, commit signing, branch protection, and repository rulesets.
- Automate the creation and maintenance of software bills of materials (SBOMs) and vulnerability exploitability exchange (VEX) data for delivered software.
- Move security checks to the earliest practical development stages, such as developer workstations, pre-commit checks, and pull requests.
- Partner with engineering teams to embed security into their workflows through clear standards and guidance.
- Apply AI tooling to accelerate vulnerability triage, remediation, and security automation, and evaluate emerging AI capabilities for the toolchain.
Benefits
- The role may be eligible for bonuses and equity.
- Comprehensive benefits package.
Stand Out From the Crowd
Upload your resume and get instant feedback on how well it matches this job.
What This Job Offers
Job Type
Full-time
Career Level
Senior
Education Level
No Education Listed
