Cybersecurity Engineer (Expert)

Join Pueo Business Solutions LLC as a senior cybersecurity engineer supporting the design and security of air-gapped Kubernetes and OpenShift platforms operating within classified enclaves. The role integrates CI/CD security automation, federal compliance evidence, Zero Trust controls, and incident response operations to reduce authorization timelines and maintain secure operations in SCIF environments.

Role Overview

Design and secure container platforms for mixed-sensitivity workloads in disconnected environments, including multi-tenant cluster architecture, secure artifact governance, and compliance-aligned security control implementation. Support platform assessment and operation while maintaining required data integrity and operational readiness in classified settings.

Key Responsibilities

• Design and assist implementation of multi-tenant Kubernetes/OpenShift clusters in disconnected enclaves.
• Manage registry governance, including image signing, SBOM/provenance, vulnerability gating, and offline patching processes.
• Implement admission control using OPA Gatekeeper and Kyverno, plus RBAC to support multi-tenancy in classified environments.
• Assist with the design and securing of CI/CD pipelines, integrating SAST, DAST, IaC scanning, and automated compliance checks.
• Generate RMF/ATO evidence through OSCAL mappings and eMASS integration.
• Enforce promotion gates that require signed/provenanced artifacts and successful STIG checks.
• Tailor NIST 800-53 controls for containerized systems using shared responsibility matrices.
• Apply and track Kubernetes/Docker/OpenShift DISA STIGs and manage related exceptions.
• Implement continuous monitoring using CONMON dashboards with on-prem tooling such as Prometheus, Falco, and auditd.
• Reduce ATO lead times using automation and evidence generation.
• Implement Zero Trust in Kubernetes with mTLS, service mesh (SPIFFE/SPIRE), and identity propagation across build and runtime layers.
• Operate offline PKI with short-lived certificates and air-gapped roots.
• Design east-west segmentation and support cross-domain artifact transfer with tamper-evident controls.
• Lead or contribute to security initiatives requiring cross-functional coordination.
• Manage competing priorities and complex stakeholder relationships.
• Architect secure, scalable containerized platforms for mixed-sensitivity workloads in SCIFs.
• Map CI/CD artifacts to RMF/ATO controls and accelerate authorization timelines through automation.
• Tailor and reconcile federal compliance requirements across NIST, CNSS, and program-specific directives.
• Implement and enforce Zero Trust end-to-end, from build through runtime.
• Operate and troubleshoot Kubernetes clusters in air-gapped enclaves with minimal external support.
• Detect, investigate, and respond to security incidents while maintaining data integrity in classified environments.
• Coordinate between development, security, and operations teams to implement secure, compliant practices.
• Design and execute disaster recovery and resilience strategies across isolated sites.

Required Qualifications

• Active/current Top Secret security clearance with SCI eligibility.
• Ability to obtain and maintain a CI poly.
• Bachelor’s degree in a related field and 12 years of experience, or additional 4 years of experience in lieu of a completed degree for a total of 16+ years.
• Possess one of the following IAT III certifications in compliance with DoD 8570.01-M and DoD Directive 8140 (e.g., CASP+ CE, CCNP Security, CISA, CISSP (or Associate), GCED, GCIH, CCSP).
• Extensive experience working with Kubernetes, OpenShift, RKE2, and container registry management in air-gapped and classified environments.
• Deep understanding of CI/CD pipeline architectures in disconnected networks.
• Expertise in federal cybersecurity frameworks including NIST 800-53, DISA STIGs, RMF, and ATO processes.
• Familiarity with security testing tools including SAST, DAST, IAST, and IaC, plus automated compliance validation.
• Proven ability enforcing Zero Trust principles, PKI management, and network segmentation in classified environments.
• Strong ability mapping pipeline artifacts to RMF/ATO controls and supporting security operations during incidents.
• Extensive experience in cybersecurity design and architecture.

Technologies

• Kubernetes, OpenShift, RKE2
• Container registry management
• OPA Gatekeeper, Kyverno
• CI/CD pipelines
• SAST, DAST, IaC
• OSCAL, eMASS
• NIST 800-53, DISA STIGs, RMF, ATO
• CONMON, Prometheus, Falco, auditd
• mTLS, SPIFFE, SPIRE, PKI, SPIFFE/SPIRE service mesh
• Docker, CNSS

Desired Qualifications

• Active Top Secret security clearance with SCI eligibility and current CI poly.
• Relevant certifications such as CKA, CKS, GSEC, RHCSA/RHCE, or CASE.
• Some experience leading security projects and initiatives.
• Team collaboration experience, including work in mixed technical teams.

Location and Clearance

• Location: McLean, VA (onsite)

Compensation

• Salary range: USD 147,742 - 167,888 per year