Information Systems Security Engineer

Second Front Systems

. Architect identity and access management designs across AWS, Azure, and GCP .

Posted 11/9/2026full-timeRemote • United StatesMid-LevelSenior💰 $200,000 - $210,000 per yearWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates expertise in architecting identity and access management solutions across AWS, Azure, and GCP, with a strong focus on compliance with NIST standards and federal authorization processes. Proficient in producing technical documentation and diagrams while guiding security assessments and implementing Zero Trust principles.

Highest-signal resume keywords

Identity And Access ManagementCloud Security ArchitectureNIST 800-53 ComplianceAWS/Azure/GCP SecurityDoD RMF Experience

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

Security EngineeringCloud Security ArchitectureIdentity And Access ManagementVPC/VNet DesignData-Flow DiagramsCloud IAMKMS/HSMLogging And MonitoringCI/CDZero Trust Principles

Tools & Technologies

LucidchartDraw.ioVisioGuardDutySecurity HubDefender For CloudGovCloudContainersKubernetesEMASS

Certifications & Qualifications

DoD 8570/8140 IASAE Level IICISSPCASP+CSSLPAWS Certified Security – SpecialtyAZ-500Google Professional Cloud Security Engineer

Industry Keywords

NIST 800-37DISA Cloud Computing SRGSTIGsDoD ICAM PolicyDoD Zero Trust Reference ArchitectureFederal AuthorizationsSecurity ClearanceU.S. CitizenshipApproved Hiring HubPPSM Registrations

Tech Stack

Tools & technologies

AWSAzureCloudGoogle Cloud PlatformKubernetes

About the role

Key responsibilities & impact

Architect identity and access management designs across AWS, Azure, and GCP
Build and maintain authorization boundary, network architecture, and data-flow diagrams
Translate engineering and architecture decisions into RMF artifacts, SSP sections, control narratives, PPSM registrations, and significant change impact analyses
Evaluate designs and new services against NIST 800-53, DISA Cloud Computing SRG, STIGs, and FedRAMP requirements
Govern security and authorization impacts of architecture changes, customer integrations, and new services
Advise ISSMs and ISSOs on significance and re-authorization requirements
Collaborate with Solutions Architects and customer architects during onboarding, design, and change activities
Establish Zero Trust principles, infrastructure-as-code guardrails, and compliance-as-code practices
Serve as technical subject matter expert during assessments, readiness reviews, and audits
Guide SCAs and Authorizing Officials through architecture and identity design

Requirements

What you’ll need

5–8 years of hands-on security engineering, cloud security architecture, or information assurance experience
Minimum 4 years designing and securing production workloads in AWS, Azure, or GCP
Minimum 3 years supporting DoD or federal authorizations under RMF
Expert fluency in identity and access management, including SAML, OIDC/OAuth 2.0, MFA, RBAC/ABAC, privileged access management, cloud-native IAM, and DoD PKI/CAC authentication
Extensive hands-on experience architecting and securing AWS, Azure, and/or GCP environments
Experience with VPC/VNet design, cloud IAM and account structure, KMS/HSM, logging and monitoring, GuardDuty, Security Hub, Defender for Cloud, GovCloud, containers, Kubernetes, and CI/CD
Ability to produce architecture, authorization boundary, and data-flow diagrams using Lucidchart, draw.io, or Visio
Strong working knowledge of NIST 800-37, NIST 800-53 Rev. 4/5, eMASS or similar GRC tools
Familiarity with DISA PPSM, CAL, DISA Cloud Computing SRG, STIGs, DoD ICAM policy, and DoD Zero Trust Reference Architecture
Active U.S. Secret security clearance required
DoD 8570/8140 IASAE Level II baseline certification (CISSP, CASP+, CSSLP) required or obtainable within 90 days
At least one professional-level cloud certification required or obtainable within 6 months: AWS Certified Security – Specialty, AZ-500, or Google Professional Cloud Security Engineer
U.S. citizenship required
Must reside in an approved hiring hub: DC/Maryland/Virginia or Denver/Colorado Springs, CO

Benefits

Comp & perks

100% employer-paid medical, dental, and vision coverage for you and your dependents
401(k) with a 3% company contribution
Comprehensive wellness benefits, including a One Medical membership, mental health resources, family planning support, and more
Equity incentive plan
New hire technology and home office stipend
Annual professional development stipend
Flexible paid time off, plus all federal holidays
Generous parental leave
Flexible remote work opportunities
Employee referral bonus program
Potential eligibility for discretionary bonuses