Staff Security Engineer

Bixal is a consulting company that helps governments and organizations deliver better services and experiences through evidence-based knowledge and technology. The Staff Security Engineer will embed secure-by-design controls into a federal agency developer platform, automate compliance evidence collection, and partner with platform and security teams to maintain continuous FedRAMP compliance while enabling engineering velocity.

Responsibilities:

• Design and implement secure-by-design controls, policy-as-code, and identity federation across the platform
• Build audit-evidence automation to support continuous compliance and reduce manual audit burden
• Lead threat modeling, code scanning, dependency controls, and vulnerability remediation efforts
• Align technical controls and evidence collection to regulatory, privacy, and federal audit requirements (e.g., NIST SP 800-53, FedRAMP)
• Design and implement identity, access, encryption, and data protection controls in production systems
• Reduce security risk through automation, monitoring, and preventive controls embedded directly in delivery workflows
• Act as an engineering partner who ships fixes and enables teams to move fast safely, not solely a checklist-based reviewer
• Collaborate with ISSOs/ISSEs and the Platform Enablement team on ATO and continuous monitoring (ConMon) activities
• Other relevant duties as qualified and trained to perform

Requirements:

• This is a fully remote position that can be worked anywhere in the U.S
• Candidates must be legally authorized to work in the US
• Bixal does not provide visa sponsorship
• • Bachelor's degree and at least 8 years of related experience, or an equivalent combination of education and experience
• • Demonstrated leadership building secure engineering practices, including threat modeling, code scanning, dependency controls, and vulnerability remediation
• • Experience aligning technical controls and evidence collection to regulatory, privacy, and audit requirements
• • Proven ability to design and implement identity, access, encryption, and data protection controls in production systems
• • Hands-on track record reducing security risk through automation, monitoring, and preventive controls embedded in delivery workflows
• • Experience supporting FISMA Moderate or higher ATO processes for federal systems
• • Familiarity with policy-as-code tooling, Terraform security modules, and CI/CD-embedded security scanning (e.g., Snyk, CodeQL)
• • Experience with identity federation (OIDC/SAML) in federal environments (e.g., Login.gov integration)
• • Prior experience supporting federal financial-data systems