• Support recurring continuous monitoring reviews by identifying new vulnerabilities, configuration drift, outdated dependencies, and changes affecting previously assessed applications.

• Communicate assessment results directly to technical and nontechnical stakeholders, including customers who may need help understanding findings and remediation expectations.

• Produce clear assessment records that document the scope, methodology, evidence reviewed, findings identified, risk analysis performed, and remediation status.

What You Bring

• Posses 5 to 7 years of hands-on experience in application security, product security, vulnerability assessment, cloud security, penetration testing, DevSecOps, or a closely related technical security discipline.

• Strong understanding of common application and cloud vulnerabilities, including the OWASP Top 10, insecure configurations, dependency risk, secrets exposure, authentication weaknesses, authorization failures, and software supply chain threats.

• Hands-on experience assessing applications or services deployed in AWS, Azure, or Google Cloud. Direct AWS experience is strongly preferred.

Working knowledge of containers, Docker, Kubernetes, container registries, CI/CD pipelines, and modern software delivery practices.

• Experience using multiple security testing technologies, such as SAST, DAST, software composition analysis, container scanning, infrastructure-as-code scanning, secrets detection, and vulnerability scanners.

• The ability to interpret CVEs, CVSS vectors, EPSS scores, CISA KEV entries, vendor advisories, exploit information, and other sources used to assess vulnerability risk.

• Experience reviewing SBOMs and investigating vulnerable open-source or third-party software dependencies.

• Working knowledge of DISA STIGs, Security Requirements Guides, CIS Benchmarks, and secure configuration practices.

• Practical understanding of NIST SP 800-53, NIST SP 800-37, continuous monitoring, and the role technical assessment evidence plays in government authorization programs.

• The ability to explain a technical finding clearly, defend a risk conclusion, and provide useful remediation guidance to software engineers and customers.

• Sound judgment when working through incomplete information, conflicting scan results, and security issues without an obvious resolution.

• Demonstrated experience interpreting security scan results and independently validating whether reported vulnerabilities are accurate, reachable, and exploitable.

• This position requires the ability to obtain and maintain a Public Trust determination.

• U.S. citizenship is required for this role.

Preferred

• Experience supporting FedRAMP Moderate, FedRAMP High, DoD RMF, or other government authorization programs.

• Experience securing or assessing Kubernetes-based DevSecOps platforms, platform-as-a-service environments, or multi-tenant cloud services.

• Familiarity with GitLab, Docker, Kubernetes, Terraform, Anchore, Trivy, Tenable, and cloud-native observability tooling.

• Experience working directly with software development teams to remediate vulnerabilities and improve secure development practices.

• Certifications such as Security+,CySA+, CSSLP, AWS Certified Security, Certified Kubernetes Security Specialist, GIAC, or comparable technical credentials.

• A strong interest in protecting national security systems and improving how mission software is evaluated and delivered.

The base salary for this position will fall between $155,000 and $175,000. Your ultimate compensation will be determined by professional background, technical proficiency, seniority, and regional cost factors. Furthermore, this opportunity includes potential eligibility for equity awards and discretionary bonuses, rounding out a comprehensive total rewards offering.

Success at 2F Looks Like:

• A proactive and solutions oriented mindset

• Viewing obstacles as opportunities for growth

• Having a bias toward action and tangible, measurable results

• Being team-oriented with a focus on personal responsibility and autonomy

Perks & Benefits:

This role is a full time position. As a public benefit corporation, we’re a team of purpose-driven trailblazers transforming the future of U.S. national security. We hire the best to do their best and, as such, we are committed to providing the perks and benefits you need to be successful—both in- and outside the workplace.

Perks of Joining Our Team:

• Competitive salary

• 100% employer-paid medical, dental, and vision coverage for you and your dependents

• 401(k) with a 3% company contribution

• Comprehensive wellness benefits, including a One Medical membership, mental health resources, family planning support, and more

• Equity incentive plan

• New hire technology and home office stipend

• Annual professional development stipend

• Flexible paid time off, plus all federal holidays

• Generous parental leave

• Flexible remote work opportunities

• Employee referral bonus program

Visit our careers page to learn more.

Who We Are:

Second Front Systems (2F) is a public-benefit software company powering software for the free world. We eliminate the friction that slows innovation, enabling faster, more secure development and deployment of software across government and regulated networks. Built by national security veterans and backed by top-tier venture capital, our platform is trusted by the world’s leading organizations to cut deployment timelines from years to weeks. We move fast, solve hard problems, and deliver trusted capabilities where they’re needed most. Our work strengthens global security and gives the United States and its allies a lasting competitive advantage. Learn more at secondfront.com .

One last thing:

We are an equal opportunity employer and all qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity or expression, pregnancy, age, national origin, disability status, genetic information, protected veteran status, or any other characteristic protected by law.

Are you ready to join our team:

To apply, click the “Apply for This Job” button at the top or bottom of this page and complete the application form. This position will remain open until filled, and applications will be reviewed on a rolling basis.

State notices:

Colorado:

In accordance with Colorado law, applicants may redact their date of birth, dates of attendance, and dates of graduation from any uploaded documents.

Maryland:

Under Maryland law, an employer may not require or demand, as a condition of employment, prospective employment, or continued employment, that an individual submit to or take a polygraph examination or similar test. An employer who violates this law is guilty of a misdemeanor and subject to a fine not exceeding $100.