> Markdown version of [/jobs/ext/2718988-dod-product-security-engineer](https://www.wearedevelopers.com/jobs/ext/2718988-dod-product-security-engineer). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # DoD Product Security Engineer - **Company:** Forterra Pressure Pipe, Inc. - **Location:** Clarksburg, MD, United States - **Experience:** Expert - **Contract:** Permanent contract - **Skills:** C (Programming Language), Systems Engineering, C++ (Programming Language), Code Review, Cyber Security, Computer Engineering, Continuous Integration, DevOps, Federal Information Processing Standards (FIPS), Firmware, Fuzz Testing, Python (Programming Language), Key Management, Systems Development Life Cycle, Reverse Engineering, Verification and Validation (Software), Software Vulnerability Management, Data Logging, Software Security, Information Technology, U-Boot, Industrial Software, Devsecops, Static Application Security Testing, Dynamic Application Security Testing - **Published:** September 4, 2026 - **Apply:** https://startup.jobs/senior-dod-product-security-engineer-forterra-company-8788612 ## About the Role * 5+ years in security engineering or a closely related field, with the depth to be the security decision-maker on a program. Equivalent demonstrated skill will be considered in lieu of exact tenure. * Hands-on RMF/ATO experience. Ideally you've owned a full ATO end-to-end. Regardless, you are knowledgeable about every step of the ATO process and ready to act as the sole SME on it, both internally with engineers and externally with a government cyber or program office. * Practical command of the standards and frameworks for this work: NIST 800-37, 800-53, and 800-171; * DISA STIGs; and familiarity with eMASS artifact requirements, formats, and review cycles. * Able to evaluate, tailor, and defend STIG applicability both with the customer and internally, and translate STIG and control requirements into clear implementation or mitigation guidance for engineers. * Demonstrated depth in both hardware and software security, with a track record of identifying and mitigating high-impact vulnerabilities. Deep expertise in one domain and solid working competence in the other, with the ability to move fluidly between the physical and the logical. * Ability to write clear security requirements and communicate both the why and the how to software and systems engineers. * Experience with software supply-chain risk management and SBOMs, and fluency in secure-SDLC practices (SAST/DAST, code review, CI/CD). * Systems-engineering fluency: comfortable working within requirements, design reviews, and traceability. * Working knowledge of FIPS 140-3 and cryptographic module validation, and how validated cryptography, TPM/HSM-backed key management, secure boot, and signed firmware apply to embedded and mission systems. * Demonstrated ability to deal with ambiguity and learn new technologies quickly. Preferred Qualifications * Owned a full ATO package end-to-end as the responsible engineer. * Familiarity with CMMC. * Familiarity with commercial cybersecurity-engineering standards such as ISO/SAE 21434 and IEC 62443 and the judgment to apply them where DoD standards and requirements fall short. * Experience securing disconnected, embedded, or industrial systems. * CISSP or similar security certification preferred. * Offensive-security depth: disassembly and reverse engineering, fuzzing, and common exploit methodologies. * Hands-on depth in one or more of: C, C++, Python, ARM, x86, cryptography Education & Experience * BS in Computer Science, Computer Engineering, Information Security, Electrical Engineering, or a relate field, or proof of exceptional skill in lieu of a degree. * Must be a U.S. Person (as defined under ITAR) and eligible to obtain a U.S. security clearance ## Description Forterra is unleashing autonomy at scale to transform the battlefield, and the systems we field have to be, Security Engineer to own product security for a DoD program end-to-end: someone who can walk in, take the wheel, and be the single security authority in front of both our engineers and a government cyber or program office. This is a hands-on, senior individual-contributor role, not a paper-compliance seat. You'll own the RMF and ATO process for your program(s) and shape the secure architecture behind it, proposing controls, writing requirements, and driving security uplift across hardware and software. When an engineer asks why a control matters, you can explain the threat and the mission rationale; when they ask how, you can give them an implementable answer. On the functions you don't build yourself, you own the solutioning and verify the implementation. You're as at home in the guts of an embedded system as you are reasoning about a CI/CD pipeline, and you know how to secure systems that live on air-gapped, offline, and intermittently connected networks. You'll report to the Product Security Lead and own the security case from threat model to signed ATO, making the architecture and control decisions that determine whether an autonomous platform can be trusted to operate securely in the field What you'll do * Own RMF and the ATO lifecycle end-to-end for your program, from control selection and tailoring through driving implementation with engineering and managing POA&Ms. You are Forterra's security SME and point of contact to the government cyber or program office, owning the security documentation, evidence, and authorization case, and delivering it in the formats and review cycles they require. * Own the security architecture, don't just document it. Set the security direction for your program: define the controls, propose the solutions, and write the requirements that engineering builds to. You are the source of the security design. That means driving secure-by-design across hardware and software, including for air-gapped, offline, and disconnected operation, making the architecture calls and standing behind them with both the threat rationale and an implementable path. This is the core of the job informing and directing security uplift across the program. * Define, write, and trace security requirements through systems-engineering processes, including * requirements and design reviews and verification and validation, so security is built in and demonstrably met. * Lead threat modeling across autonomy, embedded, and command-and-control systems, and drive risk assessments that weigh mitigations against mission needs. * Serve as the STIG subject-matter expert: communicate STIG requirements to engineering, recommend implementation and mitigation approaches, and evaluate, tailor, and defend STIG applicability in negotiation with the customer. * Engineering owns hands-on-keyboard hardening; you own the expertise, the requirement translation, and the authorization case. * Own the solutioning and verify the implementation of security monitoring, logging, and detection; of secure update strategy (signed, atomic, recoverable firmware/OS updates); and of CVE and vulnerability management, even where other teams do the building. * Partner in software supply-chain security, SBOMs, and the secure SDLC (SAST/DAST, code review, CI/CD) helping move the program toward a DevSecOps pipeline built for security. * Audit embedded and application code for vulnerabilities, drive remediation with internal teams and vendors, and collaborate across systems, safety, test, and DevOps to meet product- and program-level security needs ## Related Videos - [Security Pitfalls for Software Engineers](https://www.wearedevelopers.com/videos/726-security-pitfalls-for-software-engineers) - [From DevOps to Scaled DevOps: How We’re Rebuilding Continuous Delivery as a Platform](https://www.wearedevelopers.com/videos/100018-from-devops-to-scaled-devops-how-we-re-rebuilding-continuous-delivery-as-a-platform) - [Playing Pong on a shoulder press machine](https://www.wearedevelopers.com/videos/100140-playing-pong-on-a-shoulder-press-machine) - [One Pipeline, Three Regulator - SBOM Compliance for the Developer](https://www.wearedevelopers.com/videos/100169-one-pipeline-three-regulator-sbom-compliance-for-the-developer) - [DevOps Maturity Check – a way to balance autonomy and alignment](https://www.wearedevelopers.com/videos/58-devops-maturity-check-a-way-to-balance-autonomy-and-alignment) - [Agent Smith Gets Hardware: Autonomous IoT Hacking From Debug Port to Cloud API](https://www.wearedevelopers.com/videos/100258-agent-smith-gets-hardware-autonomous-iot-hacking-from-debug-port-to-cloud-api) ## Related Articles - [Dev Digest 134 - Where pixels sing?](https://www.wearedevelopers.com/magazine/477-dev-digest-134-where-pixels-sing) - [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed) - [How We Built a Worry-Free System That Runs for 10+ Years – And What We’d Do Again](https://www.wearedevelopers.com/magazine/751-how-we-built-a-worry-free-system-that-runs-for-10-years-and-what-we-d-do-again) - [9 Ways to Make Money Hacking](https://www.wearedevelopers.com/magazine/333-9-ways-to-make-money-hacking) - [Dev Digest 216: CyberSec + Mythos, Stack Overflow for Agents & DOOM in TTF](https://www.wearedevelopers.com/magazine/728-dev-digest-216-cybersec-mythos-stack-overflow-for-agents-doom-in-ttf) - [The Overflow: Security and Privacy](https://www.wearedevelopers.com/magazine/715-the-overflow-security-and-privacy)