> Markdown version of [/jobs/ext/4033494-senior-security-engineer-cleared](https://www.wearedevelopers.com/jobs/ext/4033494-senior-security-engineer-cleared). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Senior Security Engineer (Cleared) - **Company:** Rise8, Inc. - **Location:** Colorado Springs, CO, United States - **Experience:** Expert - **Salary:** $143,824.0 - $179,780.0 - **Contract:** Permanent contract - **Skills:** Application Programming Interfaces (APIs), Artificial Intelligence, Amazon Web Services, Microsoft Azure, Cloud Computing, Continuous Delivery, Continuous Integration, Distributed Systems, Identity and Access Management, Python (Programming Language), Red Hat Enterprise Linux, Zero Trust Network Access, Software Safety, Software Factory, Software Requirements Analysis, Delivery Pipeline, Terraform, Devsecops, Plan of Action and Milestones - **Published:** October 30, 2026 - **Apply:** https://www.careerbuilder.com/job-details/senior-security-engineer-cleared-colorado-springs-co--82316f4c-260d-4074-a236-f1df6e872698 ## About the Role Government Organizations, Time Management, Continuous Deployment/Delivery, Technical/Engineering Design, Product Design, Customer Experience, Sales Pipeline, Risk Management, Cloud Computing, Regulations, * 6-10 years of experience in cloud/platform operations, DevSecOps, or security engineering. * Deep technical fluency in the security surface of major cloud platforms (AWS GovCloud, Azure GCC High), including where default settings are insecure. * Hands-on pipeline construction: you have built and hardened production CI/CD platforms, not merely consumed them. * Infrastructure as Code (Terraform) as your standard method for managing infrastructure and security controls. * Direct experience applying control frameworks (NIST 800-53, FedRAMP, CMMC) to real production systems. * Strong programming capability in Python, Go, or Rust at the level required to build custom security tools, admission controllers, and evidence pipelines. * The ability to hold both vocabularies fluently: stating controls to developers as system requirements and pipeline gates to assessors as control satisfaction. Certifications & DoD 8140 Compliance * Rise8 Standard: No certification is required to interview or receive an offer. We evaluate candidates on practical engineering capabilities, code delivery, and compliance problem-solving-not test scores. * Contract Requirements (DoD 8140 / 8570): Specific customer engagements and Department of Defense programs may require an approved baseline certification (e.g., DoD 8140.03 / 8570.01-M) to obtain elevated administrative privileges or access to customer enclaves. Candidates already holding an applicable certification will be eligible for immediate deployment to these contracts. For candidates hired without one, Rise8 will support and sponsor obtaining the required credential if assigned to a billable role that mandates it. * Relevant baseline credentials worth mentioning (DoD IAT Level III / CSSP / IAM Level III aligned): CISSP, CKS, CCSP, AWS Security - Specialty, Red Hat RHCE, GIAC (GSLC/GCIH), or equivalents. What helps * Direct experience carrying an ATO or cATO package end to end (SSP authoring, POA&M management, continuous monitoring). * Experience in Federal Agency Environments (CMS, VA, IRS, DOC, DOJ, etc.) * Experience in DoD Software Factory environments (Platform One, Space CAMP, Kessel Run) and Impact Level (IL4/IL5/IL6) requirements. * Experience in either private or public sector GRC Engineering. ## Description We are hiring a Senior Security Engineer to own security across both the build pipeline and the authorization package across multiple teams and program domains. You will design and harden the cloud infrastructure and CI/CD that ships our software, translate whole regulatory frameworks into code, drive program-wide Continuous ATO (cATO) adoption, and automate evidence gathering for data-driven risk reduction. This is hands-on engineering focused. Most organizations split this work between a security engineer who's abstracted from compliance and a compliance SME who rarely works embedded within the development team. With compliance and authorizations viewed as a part of continuous delivery and continuous compliance, these roles are blended into one. As a Senior Security Engineer, you own the outcomes for security and compliance for delivery. What you will own Delivery pipeline and cloud infrastructure * Own the CI/CD pipelines that deliver production software across teams, including build integrity, SLSA artifact signing, and least-privilege pipeline credentials. * Set the secure golden path patterns and landing zone architectures across AWS GovCloud / Azure GCC High environments, enforcing Zero Trust principles in code. * Secure the software supply chain across the program: dependency scanning, secret detection, SBOM generation, provenance verification, and pinned build actions. * Harden container and orchestration layers from base image selection through admission control policies (Kyverno, OPA Gatekeeper). Controls as code * Translate whole control frameworks (NIST 800-53, CMMC, FedRAMP, DISA CC SRG) into automatable technical checks, building implementations rather than documenting manual processes. * Decide where control gates sit and what they block, ensuring changes that break controls fail builds automatically before reaching assessment. * Threat model complex distributed systems and carry mitigations directly through to running code and automated guardrails. * Build and lead the adoption of agentic/AI-driven security tooling across teams, applying rigorous engineering judgment to AI safety and utility. Evidence and authorization * Own the evidence system across the program, establishing continuous collection from cloud APIs, CI/CD runners, and scanner feeds so posture derives from live data. * Author control implementation statements and inherited-versus-owned boundary splits at a level of quality that assessors accept without rework. * Drive Continuous RMF and cATO practices, keeping security posture reportable on demand and maintaining real-time POA&M status. * Implement unified control libraries so a single technical check satisfies NIST 800-53, SOC 2, and ISO 27001 simultaneously. * Train, mentor, and foster growth for security engineers across the practice., Position may require up to 25% travel in support of contract performance, customer site visits, and program activities.