# Information Systems Security Engineer at Second Front Systems

> Remote · region unclear · Unspecified · Security · open. Source: https://alderhq.app/jobs/ashby%3Asecond-front-systems%3A3d0bc8af-7cba-4aeb-87b8-b907728eb2e3 (read 2026-11-10).

## Facts (observed)

- Company: [Second Front Systems](https://alderhq.app/companies/second-front-systems)
- Location text: Remote
- Where it can be done from (inferred): Remote · region unclear (evidence: "Remote, region not stated")
- Posted: 2026-11-09 (1 days ago)
- First seen by alder: 2026-11-09 · last verified: 2026-11-09
- Reposted: 0 times · edited: 0 times
- Apply on the employer's site: https://jobs.ashbyhq.com/Second-Front-Systems/3d0bc8af-7cba-4aeb-87b8-b907728eb2e3
- Skills listed (inferred): AWS, GCP, Azure, Kubernetes, Docker

## Pay and sponsorship

- Posted pay: $200k–$210k per year (from the listing's pay field)
- Licensed UK sponsor: registered as "Second Front Systems Limited" (checked 2026-11-09, [register](https://www.gov.uk/government/publications/register-of-licensed-sponsors-workers))

## Description (the employer's text)

### Information Systems Security Engineer

Second Front Systems is looking for a technically deep, mission-focused, security-first Information Systems Security Engineer to strengthen our cybersecurity and solutions architecture practice.

Operating at the boundary between engineering delivery and DoD authorization, you will be responsible for owning the security architecture and compliance engineering view of 2F's Game Warden platform and customer applications it hosts.

You will work side by side with Solutions Architects and customers to design secure-by-design solutions and translate engineering decisions into RMF artifacts, control narratives, and authorization evidence, ensuring that solutions are defensible under DoD RMF and hold up to assessor and Authorizing Official review.

We need someone capable of designing and validating identity and access management flows (federation, SAML, OIDC/OAuth 2.0, cloud IAM, DoD PKI/CAC, privileged access) aligned with DoD ICAM and Zero Trust; producing clear authorization boundary diagrams, network architecture diagrams, and data-flow diagrams that trace CUI and sensitive data end to end; and translating technical architectures into NIST 800-53 control implementations, SSP sections, PPSM registrations, and significant change impact analyses.

As a key partner to ISSMs, ISSOs, assessors, Authorizing Officials, and engineering teams, you will serve as the technical subject matter expert during assessments, readiness reviews, and audits, and advance secure-by-design and compliance-as-code practices across cloud-native environments, serving as the bridge between architecture decisions and authorization boundaries.

Note: Candidates must reside in one of our approved hiring hubs:

• DC/Maryland/Virginia

• Denver/Colorado Springs, CO

This is a full-time position.

### What You'll Do

• Architect identity and access management designs covering federation, MFA, RBAC/ABAC, privileged access, and DoD PKI/CAC authentication across AWS, Azure, and GCP.

• Build and maintain authorization boundary diagrams, network architecture diagrams, and data-flow diagrams showing components, trust boundaries, ports, protocols, and movement of CUI and sensitive data.

• Translate engineering and architecture decisions into RMF artifacts including SSP architecture sections, AC/IA/SC/AU control narratives, PPSM registrations, and significant change impact analyses.

• Evaluate proposed designs and new services against NIST 800-53, DISA Cloud Computing SRG, STIGs, and FedRAMP requirements and recommend compliant alternatives.

• Govern security and authorization impact of architecture changes, customer integrations, and new services, advising ISSMs and ISSOs on significance and re-authorization requirements.

• Synchronize with Solutions Architects and customer architects during onboarding, design, and change activities to embed security and authorization requirements from first conversation.

• Establish Zero Trust principles, infrastructure-as-code guardrails, and compliance-as-code practices to enforce and evidence security controls automatically in cloud-native environments.

• Own the technical subject matter expert role during assessments, readiness reviews, and audits, walking SCAs and Authorizing Officials through architecture and identity design.

### What You Bring

• 5–8 years of hands-on security engineering, cloud security architecture, or information assurance; minimum 4 years designing and securing production workloads in AWS, Azure, or GCP; minimum 3 years supporting DoD or federal authorizations under RMF.

• Expert fluency in identity and access management: SSO and federation (SAML, OIDC/OAuth 2.0), MFA, RBAC/ABAC, privileged access management, cloud-native IAM (AWS IAM, GCP IAM, Azure RBAC), and DoD PKI/CAC authentication.

• Extensive hands-on experience architecting and securing AWS, Azure, and/or GCP environments including VPC/VNet design, cloud IAM and account structure, encryption and key management (KMS/HSM), logging and monitoring, native security services (GuardDuty, Security Hub, Defender for Cloud), GovCloud, and cloud-native patterns (containers, Kubernetes, CI/CD).

---
Data: alder (https://alderhq.app). Cite https://alderhq.app/jobs/ashby%3Asecond-front-systems%3A3d0bc8af-7cba-4aeb-87b8-b907728eb2e3 and the date you read it. Observed facts come from the employer's own listing; location reach, level, family and skills are inferences.