> Markdown version of [/jobs/ext/2645572-security-software-engineer](https://www.wearedevelopers.com/jobs/ext/2645572-security-software-engineer). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Security Software Engineer - **Company:** Eccalon, LLC - **Location:** Hanover, MD, United States - **Experience:** Experienced - **Contract:** Permanent contract - **Skills:** Kubernetes Security, JavaScript (Programming Language), Application Programming Interfaces (APIs), Amazon Web Services, Software System Penetration Testing, User Authentication, Microsoft Azure, C Sharp (Programming Language), Code Review, Cyber Security, Continuous Integration, DevOps, Identity and Access Management, Python (Programming Language), OpenID, Open Web Application Security, Systems Development Life Cycle, Azure Active Directory, Zero Trust Network Access, Security Assertion Markup Language (SAML), Secure Coding, Security Software, Software Engineering, Software Systems, TypeScript, Software Vulnerability Management, Data Logging, Software Security, Event Driven Architecture, GWAPT, Containerization, Information Technology, Devsecops, Docker, Plan of Action and Milestones, Static Application Security Testing, Golang, Programming Languages, Microservices, Dynamic Application Security Testing - **Published:** August 5, 2026 - **Apply:** https://www.indeed.com/viewjob?jk=3a91c2b6a5d4aa0c ## About the Role * Bachelor's degree in Computer Science, Engineering, or related field-or equivalent experience. * 3+ years of software engineering experience with a strong focus on security. * Proficiency in one or more programming languages (e.g., JavaScript/TypeScript, Python, Go, C#). * Experience with secure coding practices and frameworks. * Strong understanding of application security principles, including: + OWASP Top 10 + Secure API/REST design + Cryptography fundamentals + Authentication/authorization patterns * Experience with code scanning tools (SAST/DAST), threat modeling, and penetration testing. * Familiarity with NIST 800-171, CMMC, or FedRAMP security control requirements and evidence collection. * Hands-on experience with AWS and/or Azure security services (IAM, WAF, Security Hub, Defender, Sentinel); GCC High or GovCloud experience a plus., * Experience with container security (Docker, ECS). * Working knowledge of Zero Trust Architecture principles. * Experience building DevSecOps pipelines in regulated environments; familiarity with tools like Prisma, Checkov, Snyk, or Aqua. * Relevant certifications (any of the following): + CISSP, CSSLP, or CASP+ + OSCP + CEH + GIAC (GWAPT, GSEC, GWEB) or CCP/CCA (UK Cyber Essentials equivalent) * Experience securing microservices or event-driven architectures on ECS; background in federal or cleared environments preferred. ## Description We are seeking a Security Software Engineer to build and harden software systems supporting DoD programs operating under CMMC/NIST 800-171/FedRAMP compliance requirements. You will embed security across the SDLC-from design and code review through CI/CD and cloud deployment-working alongside engineering, DevSecOps, and IT teams in a regulated, cloud-native environment (AWS Commercial and GovCloud, Azure GCC High)., * Core Engineering & Secure Development + Design and develop secure software with a security-first mindset baked into every phase of the SDLC. + Apply secure coding standards, threat modeling, and vulnerability mitigation aligned to NIST 800-53 and CMMC Level 2/3 controls. + Conduct architecture reviews and code hardening to address OWASP Top 10 and DoD STIGs. + Automate security gates in CI/CD pipelines (SAST, DAST, dependency scanning, secrets detection). * Security Architecture & Controls + Design secure system and API architectures for multi-tenant cloud environments, including GCC High and FedRAMP-authorized platforms. + Implement IAM controls, JIT provisioning, SSO/SAML/OIDC flows, and least-privilege authorization frameworks (e.g., Cognito, Azure AD). + Instrument applications with security logging and monitoring that satisfies audit and continuous monitoring requirements (AU/SI control families). * Vulnerability Management & Response + Lead code reviews, SAST/DAST scans, and targeted penetration testing; document findings against control frameworks. + Triage and remediate vulnerabilities within POA&M timelines; maintain artifact evidence for compliance assessments. + Support incident response for application-layer events; contribute to after-action reports and corrective action plans. * Cross-functional Collaboration + Serve as the embedded security champion for engineering squads, raising the security bar through mentorship and code review culture. + Develop and deliver security training and runbooks tailored to engineering and DevOps team members. + Collaborate with DevOps/SRE to enforce secure IaC, WAF rules, network controls, and runtime monitoring across AWS and Azure environments. ## Related Videos - [Security Pitfalls for Software Engineers](https://www.wearedevelopers.com/videos/726-security-pitfalls-for-software-engineers) - [Docker Compose: Rediscovered](https://www.wearedevelopers.com/videos/1978-docker-compose-rediscovered) - [Go with the Flow: Stop the Leaks Before Your Memory's a Waterfall!](https://www.wearedevelopers.com/videos/100073-go-with-the-flow-stop-the-leaks-before-your-memory-s-a-waterfall) - [You can’t hack what you can’t see](https://www.wearedevelopers.com/videos/41-you-can-t-hack-what-you-can-t-see) - [Docker build without Docker](https://www.wearedevelopers.com/videos/100114-docker-build-without-docker) - [Scoring 2000 Products per Request: Performance Pitfalls in Golang](https://www.wearedevelopers.com/videos/2073-scoring-2000-products-per-request-performance-pitfalls-in-golang) ## Related Articles - [9 Ways to Make Money Hacking](https://www.wearedevelopers.com/magazine/333-9-ways-to-make-money-hacking) - [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed) - [Dev Digest 134 - Where pixels sing?](https://www.wearedevelopers.com/magazine/477-dev-digest-134-where-pixels-sing) - [The 12 Best Jobs for Software Engineers](https://www.wearedevelopers.com/magazine/401-the-12-best-jobs-for-software-engineers) - [How We Built a Worry-Free System That Runs for 10+ Years – And What We’d Do Again](https://www.wearedevelopers.com/magazine/751-how-we-built-a-worry-free-system-that-runs-for-10-years-and-what-we-d-do-again) - [Dev Digest 138 - Are you secure about this?](https://www.wearedevelopers.com/magazine/486-dev-digest-138-are-you-secure-about-this)