> Markdown version of [/jobs/ext/4720699-information-systems-security-engineer](https://www.wearedevelopers.com/jobs/ext/4720699-information-systems-security-engineer). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Information Systems Security Engineer - **Company:** Zachary Piper - **Location:** United States (Remote available) - **Experience:** Experienced - **Salary:** $200,000 - $210,000 - **Contract:** Permanent contract - **Skills:** Amazon Web Services, Audit Trail, Microsoft Azure, Cloud Computing, Cloud Computing Security, Cyber Security, Multi-Factor Authentication, Data Flow Control, Identity and Access Management, Key Management, Microsoft Visio, Network Architecture, Network Segmentation, OAuth, OpenID, OpenShift, Public Key Infrastructure, Role-Based Access Control, Openid Connect, Lucidchart, Zero Trust Network Access, Security Assertion Markup Language (SAML), Single Sign-On, Software Vulnerability Management, AWS Cdk, Data Logging, Information Security Management System, Google Cloud, Amazon Virtual Private Cloud (VPC), Cloudformation, Kubernetes, Cloud Migration, Opsworks, Terraform, Devsecops - **Published:** November 14, 2026 - **Apply:** https://www.clearancejobs.com/jobs/9314552/information-systems-security-engineer ## About the Role * 5-8 years of hands-on experience in security engineering, cloud security architecture, or information assurance, including at least 4 years designing and securing production workloads in AWS, Azure, or GCP. * At least 3 years supporting DoD or federal RMF authorizations, including ATO packages, technical control implementation, and authorization evidence. * Deep hands-on experience with cloud IAM, SAML, OpenID Connect (OIDC), OAuth 2.0, MFA, RBAC, ABAC, privileged access management, and DoD PKI/CAC authentication. * Experience securing cloud infrastructure through VPC/VNet design, account and network segmentation, encryption, KMS or HSM, logging, monitoring, and cloud-native security services. * Ability to produce architecture, authorization boundary, and data-flow diagrams suitable for assessor review using Lucidchart, draw.io, Visio, or similar tools. * Working knowledge of NIST SP 800-37 and NIST SP 800-53 (Rev. 4 or 5), with experience documenting controls and supporting RMF workflows in eMASS or a comparable GRC platform. * Familiarity with DISA PPSM, the Category Assurance List (CAL), DISA Cloud Computing SRG, STIGs, DoD ICAM policy, and the DoD Zero Trust Reference Architecture. * Active Secret security clearance. * DoD IASAE Level II qualifying certification, such as CISSP, CASP+, or CSSLP, or the ability to obtain one within 90 days. * A qualifying cloud security certification, such as AWS Certified Security - Specialty, Microsoft Azure Security Engineer Associate (AZ-500), or Google Professional Cloud Security Engineer, or the ability to obtain one within six months. * Ability to explain technical designs to engineering, compliance, and government stakeholders and write clear documentation for assessors., * Experience securing AWS GovCloud workloads in DoD Impact Level 4, 5, or 6 environments. * Hands-on experience with AWS multi-account architecture and services such as GuardDuty, Security Hub, CloudTrail, AWS Config, IAM, and KMS. * Experience securing containers and Kubernetes or OpenShift environments and integrating security checks into DevSecOps pipelines. * Experience implementing automated security guardrails with Terraform, CloudFormation, AWS CDK, or similar tools. ## Description Zachary Piper Solutions is seeking an Information Systems Security Engineer (ISSE) to design and secure production cloud environments that host applications for federal defense missions. You'll work with solutions architects and customer engineering teams to build security into cloud designs and translate those decisions into controls, documentation, and evidence for DoD authorization. This is a full-time, direct-hire, remote position. Candidates must reside in an approved hiring hub: Washington, DC / Maryland / Virginia or Denver / Colorado Springs, CO. An active Secret security clearance is required. Responsibilities for the Information Systems Security Engineer include: * Design and secure production workloads across AWS, Azure, and Google Cloud. Define network segmentation, account structures, encryption and key management, logging, and monitoring. * Architect identity and access management solutions for single sign-on, federation, MFA, role- and attribute-based access, and privileged access. Integrate DoD PKI and Common Access Card authentication in line with DoD ICAM and Zero Trust principles. * Create and maintain authorization boundary, network architecture, and data-flow diagrams that document trust boundaries, ports, protocols, and the movement of controlled unclassified information (CUI) and other sensitive data. * Translate architecture decisions into Risk Management Framework (RMF) artifacts, including System Security Plan (SSP) sections, control narratives for access control, identification and authentication, communications protection, and auditing, and Ports, Protocols, and Services Management (PPSM) registrations. * Evaluate proposed designs and services against NIST SP 800-53, the DISA Cloud Computing Security Requirements Guide (SRG), STIGs, and FedRAMP requirements. Recommend alternatives when a design does not meet applicable controls. * Assess the security impact of architecture changes, new services, and customer integrations. Document significant changes and advise ISSMs and ISSOs on boundary updates and potential reauthorization. * Work with solutions architects and customer teams from onboarding through deployment to incorporate security and authorization requirements into application designs and cloud migrations. * Implement cloud security monitoring, workload protection, and vulnerability management. Help engineering teams validate controls, resolve findings, and maintain authorization evidence. * Build infrastructure-as-code guardrails and compliance-as-code checks that enforce controls and collect evidence across cloud environments, containers, Kubernetes, and CI/CD pipelines. * Serve as the technical point of contact during assessments, readiness reviews, and audits. Explain architecture, identity flows, and control implementation to Security Control Assessors and Authorizing Officials.