IT Security Specialist III

About the Opportunity

The IT Security Specialist III will serve as the security lead for a cloud platform supporting a safety-of-life weather-warning system, integrating security practices across the software development lifecycle and cloud environments in a remote work environment. The platform runs on AWS with Kubernetes (EKS), uses a fully GitOps deployment model, and is defined entirely as infrastructure as code. It operates as a FISMA-Moderate environment and is maturing toward a multi-account federal landing zone. This role sits at the intersection of platform engineering, security, and compliance. The IT Security Specialist III will bring expertise in cloud security, DevSecOps, vulnerability management, compliance, and security automation as a senior member of a small, high-trust team that manages infrastructure through code and pipelines rather than manual processes.

Success in this role looks like secure, scalable, and compliant solutions that support rapid software delivery in a cloud-native environment.

What You Will Do in This Role

The IT Security Specialist III leads the design, automation, and oversight of security controls across cloud infrastructure and CI/CD pipelines.

Responsibilities include:

• Integrate security controls and automated testing into CI/CD pipelines and software development processes.
• Design and implement security architectures for AWS and/or Azure cloud environments.
• Embed security guardrails into infrastructure-as-code and GitOps workflows, including policy-as-code, secrets management, and Kubernetes cluster hardening.
• Conduct vulnerability assessments, security reviews, and remediation activities.
• Develop and maintain security automation, monitoring, and compliance solutions.
• Support compliance with federal security requirements, including NIST, FISMA, FedRAMP, and Zero Trust initiatives.
• Support Authority to Operate (ATO) and continuous monitoring activities, including maintaining System Security Plans (SSPs), control evidence, and Plans of Action and Milestones (POA&Ms).
• Collaborate with development, infrastructure, and operations teams to implement DevSecOps best practices.
• Monitor security events, investigate findings, and support incident response activities.
• Develop security documentation, policies, procedures, and technical guidance.
• Perform other duties and responsibilities as assigned.

What You Will Bring

Required Qualifications

• Bachelor’s degree in Cybersecurity, Computer Science, Information Technology, or a related field.
• 5+ years of cybersecurity, DevSecOps, or cloud security experience.
• Experience securing AWS and/or Azure cloud environments.
• Experience with CI/CD tools such as Git, Jenkins, GitHub Actions, Azure DevOps, or similar platforms.
• Experience with container security and Kubernetes environments.
• Knowledge of security frameworks, including NIST RMF, NIST 800-53, FISMA, and FedRAMP.
• Experience with vulnerability management and security scanning tools.
• Strong understanding of Identity and Access Management (IAM), Zero Trust, and secure coding practices.

Preferred Qualifications

• One or more of the following certifications: CISSP, CCSP, AWS Certified Security – Specialty, Microsoft Azure Security Engineer Associate (AZ-500), Certified Kubernetes Security Specialist (CKS), or CompTIA Security+.

Work authorization/security clearance requirements

• Ability to obtain a security clearance.

Work Environment

• This work is normally completed in a remote environment.

Physical Demands

• Prolonged periods of sitting at a desk and working on a computer.
• Must be able to access and navigate each department at the organization's and client facilities.

Travel Required

• No

Proficiency Requirement

• The employee is expected to demonstrate proficiency in all essential job functions, tools, and processes related to this position within the first 90 days of employment. This includes acquiring a thorough understanding of job-specific responsibilities, systems, and workflows as outlined during onboarding and training. Failure to meet this requirement may result in additional training, reassessment, or other actions as deemed necessary by management.