Your Dream. Our Team.
About Rise8
Rise8 builds custom, secure software for government organizations, measuring success by impact: lives saved, time returned, and missions advanced.
We think big, start small, and scale fast with elite teams across product, design, and engineering to drive continuous delivery for critical missions.
We believe customer experience starts with employee experience, so we take care of our employees. Rise8 is where you’ll do the best work of your career—supported by a culture you won’t find anywhere else. We offer competitive pay and benefits, but what sets us apart is our commitment to autonomy, growth, and a culture rooted in kindness, candor, and continuous learning.
Certified as a Great Place to Work® , with 100% of employees saying they love working here, Rise8 is where bold ideas become real capabilities. Where mission meets meaning. And where fewer bad things happen because of bad software.
About the role
We are hiring a Senior Security Engineer to own security across both the build pipeline and the authorization package across multiple teams and program domains. You will design and harden the cloud infrastructure and CI/CD that ships our software, translate whole regulatory frameworks into code, drive program-wide Continuous ATO (cATO) adoption, and automate evidence gathering for data-driven risk reduction.
This is hands-on engineering focused. Most organizations split this work between a security engineer who’s abstracted from compliance and a compliance SME who rarely works embedded within the development team. With compliance and authorizations viewed as a part of continuous delivery and continuous compliance, these roles are blended into one. As a Senior Security Engineer, you own the outcomes for security and compliance for delivery.
What you will own
Delivery pipeline and cloud infrastructure
Own the CI/CD pipelines that deliver production software across teams, including build integrity, SLSA artifact signing, and least-privilege pipeline credentials.
Set the secure golden path patterns and landing zone architectures across AWS GovCloud / Azure GCC High environments, enforcing Zero Trust principles in code.
Secure the software supply chain across the program: dependency scanning, secret detection, SBOM generation, provenance verification, and pinned build actions.
Harden container and orchestration layers from base image selection through admission control policies (Kyverno, OPA Gatekeeper).
Controls as code
Translate whole control frameworks (NIST 800-53, CMMC, FedRAMP, DISA CC SRG) into automatable technical checks, building implementations rather than documenting manual processes.
Decide where control gates sit and what they block, ensuring changes that break controls fail builds automatically before reaching assessment.
Threat model complex distributed systems and carry mitigations directly through to running code and automated guardrails.
Build and lead the adoption of agentic/AI-driven security tooling across teams, applying rigorous engineering judgment to AI safety and utility.
Evidence and authorization
Own the evidence system across the program, establishing continuous collection from cloud APIs, CI/CD runners, and scanner feeds so posture derives from live data.
Author control implementation statements and inherited-versus-owned boundary splits at a level of quality that assessors accept without rework.
Drive Continuous RMF and cATO practices, keeping security posture reportable on demand and maintaining real-time POA&M status.
Implement unified control libraries so a single technical check satisfies NIST 800-53, SOC 2, and ISO 27001 simultaneously.
Train, mentor, and foster growth for security engineers across the practice.
What we need you to have
6–10 years of experience in cloud/platform operations, DevSecOps, or security engineering.
Deep technical fluency in the security surface of major cloud platforms (AWS GovCloud, Azure GCC High), including where default settings…