Responsibilities
- Design and deploy comprehensive security measures across ground command and control systems, spacecraft hardware, and software platforms, including firmware, embedded systems, cloud applications, and operational technology.
- Build security architectures that support real-time monitoring, logging, and incident response while maintaining operational efficiency.
- Integrate zero trust principles and security controls throughout the product development lifecycle to reduce risks and minimize findings during RMF assessments.
- Apply and verify DISA STIG standards at the operating system, container, platform, and application levels during product development.
- Embed RMF security controls into CI/CD pipelines using DevSecOps methods such as Infrastructure as Code, automated security testing, and continuous monitoring tools.
- Detect and resolve vulnerabilities identified through STIG audits, scanning tools, penetration tests, and software composition analysis to sustain Authorization to Operate status.
- Support all six steps of the Risk Management Framework, with a focus on implementing controls, preparing for assessments, and addressing findings for Department of Defense and Intelligence Community programs.
- Ensure systems comply with security standards including NIST 800-53, CNSSI 1253, ICD 503, and JSIG for classified systems handling information up to TS/SCI levels.
- Assist in obtaining cloud Provisional Authorizations and managing inherited controls in classified cloud environments, such as those hosted by IL-6 certified Cloud Service Providers.
- Help develop key security documentation such as System Security Plans, Security Assessment Plans, Security Assessment Reports, and Plans of Action and Milestones.
- Act as a trusted technical representative when engaging with government information system security officers, ISSEs, and external assessors during authorization and reauthorization processes.
Work Arrangement
On-site — Denver, CO, Long Beach, CA
Other
- Must collaborate with geographically dispersed teams, including spacecraft engineers, ground operations personnel, and government stakeholders.
- May be required to participate in on-call rotations to respond to security incidents and support critical mission systems.
- Expected to operate with significant independence and accountability as a trusted, cleared member of the security team.
- Occasional travel may be necessary to government facilities, launch sites, or partner locations.
- Applicants must meet U.S. export control requirements under ITAR, which includes being a U.S. citizen, lawful permanent resident, protected individual per 8 U.S.C. 1324b(a)(3), or eligible to obtain authorization from the U.S. Department of State.
