Sr Information Systems Security Engineer

ARRO Systems, LLC is seeking a Senior Information Systems Security Engineer who will serve as the primary technical cybersecurity resource. The role involves translating various cybersecurity requirements into practical engineering solutions and integrating security throughout the system development lifecycle.

Responsibilities:

• Design and review secure application, cloud, network, identity, and data architectures using defense-in-depth, least privilege, zero-trust, and secure-by-design principles
• Translate NIST, DoD, FedRAMP, CMMC, StateRAMP/GovRAMP, and SOC 2 requirements into implementable technical specifications and security controls
• Implement and validate security controls, configuration baselines, hardening requirements, system diagrams, technical procedures, and assessment evidence
• Integrate application security testing and control validation into DevSecOps and CI/CD processes, including code analysis, dependency scanning, secret detection, and software composition analysis
• Analyze vulnerability scans, penetration tests, configuration assessments, and code-review findings; recommend and validate corrective actions
• Support DoD RMF, ATO, FedRAMP, CMMC, SOC 2, independent assessments, and continuous-monitoring activities
• Evaluate system and software changes for security, compliance, and authorization impact before implementation
• Communicate technical deficiencies and residual risks to engineering teams, the ISSO, GRC leadership, assessors, and other stakeholders

Requirements:

• Bachelor's degree in cybersecurity, computer science, information systems, engineering, or a related discipline; equivalent relevant experience may be considered
• Five or more years of experience in cybersecurity engineering, cloud security, systems engineering, application security, or a related technical role
• Experience implementing or assessing NIST SP 800-53 controls and applying the NIST Risk Management Framework
• Experience securing cloud-hosted systems, analyzing technical vulnerabilities, producing assessment-ready evidence, and communicating technical risk
• Experience with Azure Government, GCC High, Microsoft Entra ID, Microsoft Defender, Microsoft Sentinel, or comparable cloud-security technologies
• Experience supporting DoD RMF, eMASS, DISA authorization, FedRAMP, CMMC, StateRAMP/GovRAMP, or SOC 2
• Experience with DevSecOps, CI/CD pipelines, infrastructure as code, container security, and secure code-review tools such as Snyk, SonarQube, GitHub Advanced Security, Checkmarx, Veracode, or Fortify
• Experience protecting CUI or other regulated and mission-sensitive information