Sr. Principal/ Principal Product Security Engineer

Description

Relocation assistance may be available for this role.

The team builds the security of mission-critical spacecraft and flight software, covering space vehicles, their flight and guidance, navigation, and control software, simulation platforms, embedded systems, and the engineering platforms used to build and deliver them to the customer.

The role requires an active Top Secret/SCI clearance and travel of about 10% of the time.

The role is 100% on-site in Dulles, Virginia.

You will embed security across the product lifecycle, from architecture and design through implementation, testing, release, and handover to a ground system.

The role is split between building security into engineering work and supporting the Risk Management Framework (RMF) authorization effort for the program.

Responsibilities

• Work with engineering, program, systems, and cybersecurity stakeholders to improve product security processes across development, test, governance, and authorization.
• Act as a hands-on security partner to embedded software, DevOps, and ground and supporting software teams throughout the development lifecycle.
• Advise teams on secure coding, secure architecture, embedded security design, supply-chain security, and CI/CD pipeline security.
• Assess embedded and mission software through architecture reviews, code reviews, vulnerability assessments, attack surface analyses, and security testing.
• Build and maintain threat models, data-flow diagrams, trust-boundary analyses, misuse and abuse cases, and risk assessments for embedded software and supporting platforms.
• Integrate, run, and improve security tooling in GitLab CI, Jenkins, or equivalent CI/CD platforms, including SAST, SCA, secret scanning, SBOM generation, infrastructure and configuration scanning, and custom checks.
• Build security tools and automations in Python, Go, or similar languages that speed up engineering, improve visibility, and collect assurance evidence.
• Triage and validate security findings, work with engineers and technical leads to assess risk and set remediation priorities, and carry findings through to closure.
• Support secure management of third-party, open-source, and in-house software components, including dependency risk assessments, SBOM review, vulnerability management, and supply-chain activities.
• Write standard RMF artifacts, including System Security Plans, Risk Assessment Reports, Security Controls Traceability Matrices, Plans of Action and Milestones, control implementation narratives, and supporting policies and procedures.
• Support the authorization process for Platform IT (PIT) systems, working with system owners, ISSMs/ISSOs, and control assessors to obtain an Authorization to Operate (ATO).
• Explain security risks and technical findings clearly to engineers, program leaders, and non-technical stakeholders.
• Mentor software and security engineers on secure development and help set scalable product security standards across the organization.

Requirements

• Active Top Secret/SCI security clearance at the time of application.
• Level 3: 3 to 5 years of experience with a Bachelor's degree, 3 years with a Master's degree, or 1 year with a PhD.
• Level 4: at least 8 years of experience with a Bachelor's degree, 6 years with a Master's degree, or 4 years with a PhD.
• Proficiency in C or C++ and experience reviewing, developing, or securing embedded software.
• Experience with Python, Go, or a similar language for automations, integrations, or custom tooling.
• Experience with real-time operating systems (RTOS), embedded Linux, or comparable embedded platforms.
• Experience developing or security testing embedded systems and/or C/C++ applications.
• Knowledge of secure software development lifecycle practices, from requirements through architecture, implementation, test, release, and vulnerability management.
• Experience analyzing security vulnerabilities and working directly with software engineers to prioritize and fix findings.
• Strong problem-solving, troubleshooting, written communication, and technical collaboration skills.
• Familiarity with the system authorization process for achieving an ATO on PIT systems and experience conducting system security assessments.

Conditions

Active Top Secret/SCI clearance with polygraph is preferred.

A Bachelor's or Master's degree in Computer Engineering, Computer Science, Electrical Engineering, Software Engineering, Physics, or a similar technical field is preferred.

An active CISSP, CISSP-ISSEP, CSSLP, Security+, or comparable security certification is preferred.

Experience with Git and Subversion for version control is preferred.

Experience with SAST tools, triaging their findings, and coordinating fixes with software engineering teams is preferred.

Experience using SCA tools to generate SBOMs and scan software dependencies for vulnerabilities is preferred.

Experience with GitLab CI, Jenkins, or a similar pipeline platform, including adding security tooling to CI/CD pipelines, is preferred.

Experience with threat modeling and producing architecture diagrams, data-flow diagrams, attack surface analyses, and risk-based recommendations is preferred.

Familiarity with CWE, CVE, CVSS, GHSA, CISA KEV, and other vulnerability management concepts is preferred.

Familiarity with the NIST RMF, NIST SP 800-53, NIST SP 800-160, NIST SP 800-218, or equivalent frameworks is preferred.

Experience securing flight software, GNC software, spacecraft subsystems, aerospace systems, or other resource-constrained embedded platforms is preferred.

Experience with containerized build environments, artifact repositories, build system security, code signing, provenance and attestations, or software supply-chain best practices is preferred.

Primary level base salary range: $125,300.00 to $187,900.00.

Secondary level base salary range: $156,400.00 to $234,600.00.

The range is a general guide. Final base pay depends on the scope of the role and the candidate's experience, education, skills, and current market conditions.

The role may be eligible for overtime, shift differential, and a discretionary annual bonus, which rewards individual work and shared company results. Vice President and Director roles may also be eligible for long-term incentives.

The application window is estimated at 20 days from the posting date, and may be shortened or extended based on business needs and candidate availability.

Benefits

• Health insurance coverage.
• Life and disability insurance.
• A savings plan.
• Company-paid holidays.
• Paid time off (PTO) for vacation and personal business.