Staff Security Engineer

Bixal is a consulting company headquartered in Fairfax, VA, helping governments and organizations deliver better services and experiences through evidence-based knowledge and technology. The Staff Security Engineer will embed secure-by-design controls, policy-as-code, identity federation, and automated audit-evidence collection into a federal agency developer platform while partnering with security and platform teams to maintain continuous FedRAMP compliance.

Responsibilities:

• Design and implement secure-by-design controls, policy-as-code, and identity federation across the platform
• Build audit-evidence automation to support continuous compliance and reduce manual audit burden
• Lead threat modeling, code scanning, dependency controls, and vulnerability remediation efforts
• Align technical controls and evidence collection to regulatory, privacy, and federal audit requirements (e.g., NIST SP 800-53, FedRAMP)
• Design and implement identity, access, encryption, and data protection controls in production systems
• Reduce security risk through automation, monitoring, and preventive controls embedded directly in delivery workflows
• Act as an engineering partner who ships fixes and enables teams to move fast safely, not solely a checklist-based reviewer
• Collaborate with ISSOs/ISSEs and the Platform Enablement team on ATO and continuous monitoring (ConMon) activities
• Other relevant duties as qualified and trained to perform

Requirements:

• Bachelor's degree and at least 8 years of related experience, or an equivalent combination of education and experience
• Demonstrated leadership building secure engineering practices, including threat modeling, code scanning, dependency controls, and vulnerability remediation
• Experience aligning technical controls and evidence collection to regulatory, privacy, and audit requirements
• Proven ability to design and implement identity, access, encryption, and data protection controls in production systems
• Hands-on track record reducing security risk through automation, monitoring, and preventive controls embedded in delivery workflows
• Experience supporting FISMA Moderate or higher ATO processes for federal systems
• Must be able to obtain and maintain a Tier 4 High Risk Public Trust clearance
• Familiarity with policy-as-code tooling, Terraform security modules, and CI/CD-embedded security scanning (e.g., Snyk, CodeQL)
• Experience with identity federation (OIDC/SAML) in federal environments (e.g., Login.gov integration)
• Prior experience supporting federal financial-data systems