Security Engineer

Oddball is a company focused on delivering quality software for the federal space. The Security Engineer will work with the SEC and DevSecOps teams to harden cloud environments, maintain Authority to Operate (ATO), and reduce the Plan of Action and Milestones (POAM) backlog. The role involves automating secure infrastructure, assessing and remediating security findings, conducting Security Impact Analyses, and coordinating with engineers and stakeholders.

Responsibilities:

• Deploy and automate CI/CD pipelines and establish IaC using modern DevSecOps techniques including serverless and Zero Trust patterns
• Own the POAM process end to end — develop a plan of attack with target dates, track progress in real time, and close findings proactively
• Assess incoming security findings, identify duplicates and dependencies, and develop LOEs for remediation
• Conduct Security Impact Analyses (SIAs) to achieve and maintain ATO
• Implement data tagging and sensitivity management practices to reduce the SEC's ATO management burden
• Engage directly with engineers and external stakeholders to drive remediation forward
• Maintain a live dashboard and tracker for all security findings and POAM status
• Performs other related duties as assigned

Requirements:

• Hands-on experience remediating POAMs and navigating the federal ATO process
• Proficiency with AWS environments and cloud security practices
• Experience with CI/CD pipelines, CloudFormation, and infrastructure as code
• Familiarity with Zero Trust principles and federal cybersecurity frameworks including FISMA and NIST 800-53
• Strong organizational skills with the ability to manage multiple findings, timelines, and stakeholders simultaneously
• Comfortable engaging directly with engineers and external stakeholders to move remediation forward
• Communicates clearly and openly, whether updating a tracker or presenting findings to leadership
• Applicants must be authorized to work in the United States
• Bachelor's degree
• Experience with Docker and containerized environments