Cybersecurity Assessment Engineer Second Front Systems (2F) is seeking a Cybersecurity Assessment Engineer to perform hands-on security assessments of software deployed through the Game Warden platform. This is not a scan-operator or checklist-only position. We are looking for someone who can investigate technical findings, understand how an application is built and deployed, distinguish meaningful risk from scanner noise, and give engineering teams practical guidance they can act on. Reporting to the Head of Product Security & Compliance, you will assess customer applications, container images, cloud configurations, software dependencies, and supporting artifacts before and after deployment. You will work directly with Product, Platform Engineering, DevOps, Mission Success, and customer development teams to identify vulnerabilities, evaluate their actual risk, and determine whether an application is ready to operate within Game Warden. Your work will directly influence deployment decisions, vulnerability remediation, continuous monitoring, and the security posture of a platform supporting mission-critical government software. Note: Candidates must reside in one of our approved hiring hubs: • DC/Maryland/Virginia • Raleigh/Durham/Chapel Hill, NC • Denver/Colorado Springs, CO • Dallas/Fort Worth, TX This is a full-time position. What You'll Do • Perform technical security assessments of customer applications and services seeking deployment through the Game Warden platform. • Review application artifacts, container images, software dependencies, infrastructure configurations, data flows, APIs, and deployment documentation to identify security weaknesses. • Analyze results from SAST, DAST, software composition analysis, container scanning, infrastructure-as-code scanning, secrets detection, and vulnerability management tools. • Serve as a trusted technical security partner to Mission Success, Platform Engineering, DevOps, and customer development teams. • Partner with Security Authorization Specialists to ensure technical assessment results and supporting evidence can be used for RMF, FedRAMP, and continuous monitoring activities. • Provide developers with clear remediation guidance that identifies the vulnerable component, explains the risk, and recommends specific corrective actions. • Evaluate requests for vulnerability exceptions or delayed remediation. Validate the stated rationale, examine compensating controls, and provide a documented risk recommendation to the appropriate approving authority. • Support recurring continuous monitoring reviews by identifying new vulnerabilities, configuration drift, outdated dependencies, and changes affecting previously assessed applications. • Communicate assessment results directly to technical and nontechnical stakeholders, including customers who may need help understanding findings and remediation expectations. • Produce clear assessment records that document the scope, methodology, evidence reviewed, findings identified, risk analysis performed, and remediation status. What You Bring • Posses 5 to 7 years of hands-on experience in application security, product security, vulnerability assessment, cloud security, penetration testing, DevSecOps, or a closely related technical security discipline. • Strong understanding of common application and cloud vulnerabilities, including the OWASP Top 10, insecure configurations, dependency risk, secrets exposure, authentication weaknesses, authorization failures, and software supply chain threats. • Hands-on experience assessing applications or services deployed in AWS, Azure, or Google Cloud. Direct AWS experience is strongly preferred. Working knowledge of containers, Docker, Kubernetes, container registries, CI/CD pipelines, and modern software delivery practices. • Experience using multiple security testing technologies, such as SAST, DAST, software composition analysis, container scanning, infrastructure-as-code scanning, secrets detection, and vulnerability scanners. • The ability to interpret CVEs, CVSS vectors, EPSS scores, CISA KEV entries, vendor advisories, exploit information, and other sources used to assess vulnerability risk. • Experience reviewing SBOMs and investigating vulnerable open-source or third-party software dependencies. • Working knowledge of DISA STIGs, Security Requirements Guides, CIS Benchmarks, and secure configuration practices. • Practical understanding of NIST SP 800-53, NIST SP 800-37, continuous monitoring, and the role technical assessment evidence plays in government authorization programs. • The ability to explain a technical finding clearly, defend a risk conclusion, and provide useful remediation guidance to software engineers and customers. • Sound judgment when working through incomplete information, conflicting scan results, and security issues without an obvious resolution. • Demonstrated experience interpreting security scan results and independently validating whether reported vulnerabilities are accurate, reachable, and exploitable. • This position requires the ability to obtain and maintain a Public Trust determination. • U.S. citizenship is required for this role. Preferred • Experience supporting FedRAMP Moderate, FedRAMP High, DoD RMF, or other government authorization programs. • Experience securing or assessing Kubernetes-based DevSecOps platforms, platform-as-a-service environments, or multi-tenant cloud services. • Familiarity with GitLab, Docker, Kubernetes, Terraform, Anchore, Trivy, Tenable, and cloud-native observability tooling. • Experience working directly with software development teams to remediate vulnerabilities and improve secure development practices. • Certifications such as Security+,CySA+, CSSLP, AWS Certified Security, Certified Kubernetes Security Specialist, GIAC, or comparable technical credentials. • A strong interest in protecting national security systems and improving how mission software is evaluated and delivered. The base s