Cyber Security Engineer

ARRO Systems LLC is seeking a Cybersecurity Engineer (ISSE) to secure its cloud platform, software delivery pipelines, and corporate environment. The role focuses on Azure Government security, continuous monitoring and authorization support for FedRAMP and DoD efforts, CMMC Level 2 readiness, and building a sustainable company-wide security program.

Responsibilities:

• Cloud Infrastructure Security: Harden ARRO's Azure Government environment, including identity and access management, network segmentation, encryption, key and secrets management, and logging. Enforce secure baselines through Azure Policy, Defender for Cloud, and infrastructure-as-code, using FIPS 140-validated cryptography where required
• Technical Control Implementation: Implement and validate controls against NIST SP 800-53 Rev. 5, FedRAMP baselines, the DoD CC SRG, and applicable DISA STIGs and SRGs, and translate requirements into engineering tasks for Cloud Engineering and Software Development
• DevSecOps & Pipeline Security: Integrate, tune, and maintain SAST, DAST, SCA, container, secrets, and IaC scanning in CI/CD pipelines, with security gates that engineers trust
• Application & Product Security: Review application architecture, APIs, authentication, authorization, dependencies, and data flows. Triage findings, validate exploitability, lead software supply chain and SBOM practices, and give developers clear remediation guidance
• Continuous Monitoring (ConMon): Own the technical execution of ConMon for our authorization boundary, including scan cadence, results analysis, configuration drift, system inventory, and monthly deliverables
• Authorization Lifecycle Support: Author and maintain the technical portions of the System Security Plan (SSP), including control narratives, architecture and data flow diagrams, and configuration evidence. Evaluate significant changes and prepare evidence for readiness reviews and annual assessments
• Vulnerability & POA&M Management: Run risk-based vulnerability management across cloud, corporate, and application environments using CVSS, the CISA KEV catalog, and environmental context. Drive POA&M items to closure within required timelines and prepare deviation requests with supporting evidence
• Corporate Environment & CMMC: Secure ARRO's corporate IT environment, including identity, endpoints, email and collaboration platforms, and network infrastructure. Implement NIST SP 800-171 controls, define the CUI scope boundary, and maintain the CMMC SSP and POA&M in preparation for a Level 2 assessment
• Security Program Development: Help build a sustainable, company-wide security program. Write policies and standards people actually follow, define security metrics, and reuse controls and evidence across FedRAMP, DoD, CMMC, and SOC 2
• Security Automation: Automate evidence collection, reporting, and security checks so compliance is a byproduct of engineering operations, not a monthly scramble
• Cross-Functional Partnership: Act as the go-to security engineering resource for Cloud Engineering, IT, Software Development, and Product, and communicate risks, blockers, and progress to the Director of Information Security

Requirements:

• 4+ years of hands-on experience in security engineering, cloud security, application security, or DevSecOps
• Hands-on experience securing Microsoft Azure, including Entra ID, networking, Key Vault, logging, and Azure Policy
• Experience securing enterprise IT environments, including identity, endpoints, and email and collaboration platforms
• Working knowledge of NIST SP 800-53 Rev. 5, NIST SP 800-171, NIST SP 800-37, DoD RMF, and DISA STIGs/SRGs, with experience implementing and validating controls, not only documenting them
• Experience integrating and tuning SAST, SCA, container, IaC, or secrets scanning in CI/CD pipelines, and triaging the results
• Understanding of modern software development, including APIs, containers, infrastructure-as-code, and secure development principles
• Experience producing technical security documentation, such as control implementation narratives, assessment findings, or configuration evidence
• Clear written and verbal communication, and the ability to work independently across security and engineering teams
• U.S. citizenship
• the ability to complete a background investigation and meet the personnel requirements applicable to DoD cloud systems
• Experience in a federal authorization environment: DoD Impact Level (IL) environments, DoD Provisional Authorization, FedRAMP Moderate/High, or RMF ATO activities
• Experience operating continuous monitoring, including recurring scanning, POA&M management, and significant change analysis
• Direct experience with Azure Government, Microsoft Defender for Cloud, or Microsoft Sentinel
• Experience implementing CMMC Level 2 / NIST SP 800-171 controls, or securing Microsoft 365 GCC High
• Experience with Terraform, GitHub Actions, Azure DevOps, or GitLab
• Familiarity with Tenable, Trivy, Anchore, SonarQube, Snyk, or similar tools
• Familiarity with eMASS, SSP development, and third-party assessment coordination
• Scripting or automation ability in Python, PowerShell, or Bash
• Certifications such as Security+, CySA+, CISSP, CSSLP, CCSP, or AZ-500
• Experience in defense technology, government SaaS, or other highly regulated cloud environments