Cybersecurity Engineer (ISSE)

ARRO is seeking a Cybersecurity Engineer (ISSE) to engineer and maintain security across our cloud platform, software delivery pipelines, and corporate environment. We build software that supports mission-critical defense and government operations, and this role sits at the center of how we secure it.

The work goes well beyond writing compliance artifacts or running tools. You’ll need to understand how modern cloud applications and enterprise environments are built and deployed, dig into technical findings to determine what actually matters, and work side by side with the engineers who own the systems to get fixes shipped.

Reporting to the Director of Information Security, you will secure our Azure Government environment and CI/CD pipelines, own the technical execution of continuous monitoring for our FedRAMP and DoD cloud authorization efforts, secure our corporate network and drive CMMC Level 2 readiness, and help build a sustainable, company-wide security program. You’ll work directly with Cloud Engineering, IT, Software Development, and Product.

Your work will directly shape our authorization readiness, how we ship software, and the security foundation ARRO grows on.

Note: This role requires U.S. citizenship due to access to Controlled Unclassified Information (CUI). This is a remote, full-time position.

What You’ll Do

• Cloud Infrastructure Security: Harden ARRO’s Azure Government environment, including identity and access management, network segmentation, encryption, key and secrets management, and logging. Enforce secure baselines through Azure Policy, Defender for Cloud, and infrastructure-as-code, using FIPS 140-validated cryptography where required.

• Technical Control Implementation: Implement and validate controls against NIST SP 800-53 Rev. 5, FedRAMP baselines, the DoD CC SRG, and applicable DISA STIGs and SRGs, and translate requirements into engineering tasks for Cloud Engineering and Software Development.

• DevSecOps & Pipeline Security: Integrate, tune, and maintain SAST, DAST, SCA, container, secrets, and IaC scanning in CI/CD pipelines, with security gates that engineers trust.

• Application & Product Security: Review application architecture, APIs, authentication, authorization, dependencies, and data flows. Triage findings, validate exploitability, lead software supply chain and SBOM practices, and give developers clear remediation guidance.

• Continuous Monitoring (ConMon): Own the technical execution of ConMon for our authorization boundary, including scan cadence, results analysis, configuration drift, system inventory, and monthly deliverables.

• Authorization Lifecycle Support: Author and maintain the technical portions of the System Security Plan (SSP), including control narratives, architecture and data flow diagrams, and configuration evidence. Evaluate significant changes and prepare evidence for readiness reviews and annual assessments.

• Vulnerability & POA&M Management: Run risk-based vulnerability management across cloud, corporate, and application environments using CVSS, the CISA KEV catalog, and environmental context. Drive POA&M items to closure within required timelines and prepare deviation requests with supporting evidence.

• Corporate Environment & CMMC: Secure ARRO’s corporate IT environment, including identity, endpoints, email and collaboration platforms, and network infrastructure. Implement NIST SP 800-171 controls, define the CUI scope boundary, and maintain the CMMC SSP and POA&M in preparation for a Level 2 assessment.

• Security Program Development: Help build a sustainable, company-wide security program. Write policies and standards people actually follow, define security metrics, and reuse controls and evidence across FedRAMP, DoD, CMMC, and SOC 2.

• Security Automation: Automate evidence collection, reporting, and security checks so compliance is a byproduct of engineering operations, not a monthly scramble.

• Cross-Functional Partnership: Act as the go-to security engineering resource for Cloud Engineering, IT, Software Development, and Product, and communicate risks, blockers, and progress to the Director of Information Security.

• 4+ years of hands-on experience in security engineering, cloud security, application security, or DevSecOps.

• Hands-on experience securing Microsoft Azure, including Entra ID, networking, Key Vault, logging, and Azure Policy.

• Experience securing enterprise IT environments, including identity, endpoints, and email and collaboration platforms.

• Working knowledge of NIST SP 800-53 Rev. 5, NIST SP 800-171, NIST SP 800-37, DoD RMF, and DISA STIGs/SRGs, with experience implementing and validating controls, not only documenting them.

• Experience integrating and tuning SAST, SCA, container, IaC, or secrets scanning in CI/CD pipelines, and triaging the results.

• Understanding of modern software development, including APIs, containers, infrastructure-as-code, and secure development principles.

• Experience producing technical security documentation, such as control implementation narratives, assessment findings, or configuration evidence.

• Clear written and verbal communication, and the ability to work independently across security and engineering teams.

• U.S. citizenship and the ability to complete a background investigation and meet the personnel requirements applicable to DoD cloud systems.

Nice to Have

• Experience in a federal authorization environment: DoD Impact Level (IL) environments, DoD Provisional Authorization, FedRAMP Moderate/High, or RMF ATO activities.

• Experience operating continuous monitoring, including recurring scanning, POA&M management, and significant change analysis.

• Direct experience with Azure Government, Microsoft Defender for Cloud, or Microsoft Sentinel.

• Experience implementing CMMC Level 2 / NIST SP 800-171 controls, or securing Microsoft 365 GCC High.

• Experience with Terraform, GitHub Actions, Azure DevOps, or GitLab.

• Familiarity with Tenable, Trivy, Anchore, SonarQube, Snyk, or similar tools.

• Familiarity with eMASS, SSP development, and third-party assessment coordination.

• Scripting or automation ability in Python, PowerShell, or Bash.

• Certifications such as Security+, CySA+, CISSP, CSSLP, CCSP, or AZ-500.

• Experience in defense technology, government SaaS, or other highly regulated cloud environments.

ARRO delivers trusted software to the defense community. You’ll join at a pivotal stage, with real influence over security architecture, engineering practices, and how we build. Rather than maintaining an established program, you’ll help build the technical foundation for our next stage of growth, working directly with security and engineering leadership.

ARRO is an equal opportunity employer committed to building a collaborative and inclusive workplace.