Cybersecurity Engineer - DevOps

Sphera is a global provider of enterprise software and services for environmental, health, safety, and sustainability management. The Cybersecurity Engineer will serve as a security subject-matter expert within the DevOps squad, managing compliance for software deployed in federal and DoD environments. The role focuses on RMF/ATO lifecycle management, STIG implementation, vulnerability remediation, incident response, and DevSecOps integration.

Responsibilities:

• Lead cybersecurity for software deployed in secure federal and DoD environments, ensuring compliance with applicable government security policies, access requirements, and accreditation expectations
• Execute RMF activities, including system categorization, security control selection, implementation, assessment, and ATO documentation for federal or DoD-hosted systems
• Implement, configure, and validate STIGs across layers using DISA-approved or equivalent government security tooling
• Mitigate OWASP Top 10 and application-layer vulnerabilities across services
• Monitor security controls, scan vulnerabilities, and audit systems, producing reports and coordinating remediation with development and DevOps
• Manage POA&Ms, coordinating with government security stakeholders, ISSMs, and internal teams to track and resolve open findings
• Support FedRAMP and FISMA compliance, aligning controls with NIST SP 800-53 Rev. 5
• Integrate security tooling and automated checks into CI/CD pipelines, advancing DevSecOps maturity
• Collaborate with engineers and the Principal Solutions Architect to conduct threat modeling, security design reviews, and application-level security assessments
• Maintain System Security Plans (SSPs), security architectures, and supporting ATO documentation packages in alignment with federal and DoD requirements
• Lead incident response activities for security events affecting systems deployed in secure government environments, coordinating with customer cybersecurity personnel and internal stakeholders
• Monitor SIEM alerts, analyze logs, and investigate anomalous activity
• Evaluate the security posture of third-party integrations, vendor tools, and emerging technologies for adoption in secure federal or DoD environments
• Embed security requirements into sprint planning, feature development, and release processes with the TPM, engineering squads, and product owners
• Stay informed on evolving federal, DoD, DISA, and agency-specific security policies, DISA guidance updates, and emerging threats, and proactively communicate their impact to the engineering organization

Requirements:

• U.S. citizen required; active DoD security clearance or ability to obtain and maintain one due to secure federal enclave access
• Minimum 3-5 years of hands-on cybersecurity experience in a federal, DoD or similarly regulated secure environments
• Strong working knowledge of secure federal or DoD environments, including segmented networks, access control, approved software baselines, and applicable security requirements
• Experience supporting or leading RMF processes, including ATO package preparation and submission for federal or DoD systems
• Proficiency in applying STIGs using DISA-approved tools (SCC, STIG Viewer, Nessus/ACAS) or comparable vulnerability and compliance platforms
• Solid understanding of FedRAMP Moderate and FISMA compliance, with ability to map security controls to NIST SP 800-53 Rev. 5
• Experience with vulnerability management tools (e.g., Tenable.sc, Nessus, ACAS) in federal or DoD environments
• Familiarity with enterprise security tools including SIEM, IDS/IPS, and network security controls
• DevSecOps experience, including integrating SAST, DAST, and SCA scanning into CI/CD pipelines using Azure DevOps, Jenkins, or equivalent tools
• Familiarity with PKI, CAC/PIV authentication, and certificate management in federal or DoD environments
• Strong written and verbal communication skills to translate complex security findings into actionable guidance for engineering teams and brief government stakeholders
• DoD 8570/8140 compliant certification at IAT Level II or higher (e.g., CompTIA Security+, CISSP, CEH, CAP, or equivalent)
• Bachelor's degree in Computer Science, Information Security, Cybersecurity, or a related field, or equivalent practical experience
• Experience working in segmented networks with an understanding of federal, DoD, or similarly regulated infrastructure and security requirements
• Proven time management, organizational and follow-up skills to meet deadlines
• Work effectively, independently, and in a dynamic team environment
• Excellent interpersonal skills
• Must be willing to learn new technologies and processes as needed