Senior Security Engineer
Own end-to-end security architecture, compliance (FedRAMP, CMMC), and secure supply chain practices for a federal-focused government platform on AWS. Lead technical readiness and drive secure-by-default engineering in an early-stage environment.
About the job
What You'll Do
- Architect and operationalize security across infrastructure, platform, CI/CD, and application layers, with a focus on AWS (including GovCloud) and Terraform
- Lead readiness across federal compliance frameworks — FedRAMP, CMMC, and DoD Impact Levels — translating NIST 800-53 and related controls into real engineering implementations, and owning the SSPs, POA&Ms, and technical policy documentation
- Build continuous compliance and audit-readiness workflows that make accreditation a byproduct of how we ship, not a separate workstream
- Use automated AI-driven security scanning, modern hardened-image platforms like Chainguard, and other leverage points to multiply the impact of a small security team
- Establish secure software supply chain practices: SBOMs, image signing, workload identity, and hardened deployment pipelines
- Own the technical relationship with assessors, auditors, and federal security stakeholders
- Drive a secure-by-default engineering culture
What You'll Bring
- 5+ years of hands-on experience building and securing cloud-native platforms in AWS and Terraform — you can architect controls and also implement them yourself
- Direct experience with federal authorization work — FedRAMP, CMMC, DoD IL, or comparable regulated environments
- Deep familiarity with NIST 800-53 and the ability to translate controls into pragmatic engineering work
- Strong working knowledge of modern supply chain security: SBOMs, image signing, workload identity, secure CI/CD
- Track record operating effectively in early-stage or fast-moving environments where you set the bar rather than inherit it
Strong Candidates May Also
- Have supported federal SaaS, defense tech, or regulated infrastructure companies through accreditation
- Have led a company through its first federal authorization
- Have hands-on experience with Chainguard, AI-powered security tooling, or similar leverage-multiplying platforms
- Have worked with platforms like Second Front or similar federal compliance accelerators
What Kaizen Offers
- Comprehensive medical through Oxford/United — Gold and Platinum PPO plans, with 85% of premiums covered on the Platinum plan and a $0 employee premium option
- Dental through Guardian PPO and vision through Beam, with 99% of employee premiums covered and 50% for dependents
- $100,000 in fully paid life insurance
- FSA and Dependent Care FSA
- 401(k) access through Guideline
- 16 weeks of fully paid parental leave for birthing parents; 10 weeks fully paid for non-birthing parents
- Unlimited PTO, closed for all federal holidays, and company-wide winter break the week of Christmas
- Up to $750 one-time home office or desk setup stipend for NYC-based employees
- $50/month commuter benefit
- Expensed lunch 3x a week while in the office
- Company-provided laptop
- Fully covered gym membership at Grindhouse; $100/month fitness reimbursement for remote employees
- $300/quarter pet care stipend
- $100/month utility stipend
- $500/year professional development stipend
- $250/year recreation stipend
Skills
AWS, Aws Govcloud, Terraform, FedRAMP, Cmmc, Nist 800-53, Ssps, Poa&Ms, Sboms, Image Signing, Workload Identity, Secure Ci/Cd, Chainguard, Ai-Powered Security Tooling
Similar jobs
Security Engineering jobs
Monarch
Remote
Own and scale security governance, risk, compliance, and customer assurance programs, including audits, controls monitoring, third-party risk, policies, and security questionnaires. The role requires 3–5 years of security GRC experience and hands-on understanding of IAM, endpoint, and cloud controls.
Valon
United States
Leads offensive security, threat intelligence, security testing, and incident response across applications, infrastructure, and networks. The role requires at least five years of relevant experience, cloud security expertise, AI and automation experience, and a bachelor's degree.
Anyscale
IndiaOwn Anyscale’s secure software development lifecycle, partner with engineering on secure architecture and features, and lead vulnerability management and remediation. The role requires 8+ years of product or application security experience and strong hands-on secure-development expertise.
Anyscale
San Francisco, CA
Own Anyscale’s compliance function end to end, leading SOC 2 and ISO 27001 programs, audit readiness, customer security diligence, and enterprise risk management. The role requires 7+ years in governance, risk, and compliance plus strong cloud and SaaS security-controls expertise.
Siftstack
Marina Del Rey, CA
The Senior Application Security Engineer will build secure-by-default software patterns, supply-chain controls, and developer-facing security tooling across a distributed systems platform. The role requires 5+ years of production software experience, strong application security expertise, and depth in Go or Rust.