Lead Security Engineer

Nava

Remote

Nava is at the forefront of reimagining how our government serves its people, and we’re looking for experienced security engineers to help drive this mission forward.

You will work on a small team, helping to improve and manage all aspects of the clients' systems systems, which are deployed on AWS. We work as integrated teams of Security, Infrastructure, and Software Engineers. We make heavy use of tools such as Docker, Terraform, and Jenkins and we continually evaluate new technologies as they become production-ready for government contexts.

You'll be responsible for the security of these critical systems. By doing this, you’ll help ensure that Nava continues delivering services that millions of Americans depend on. You care deeply about working on technology that affects people’s lives, and are passionate about designing for security, building secure infrastructure, and maintaining secure systems.

What you’ll do

  • Work with Software Engineers and Infrastructure Engineers to make our technical designs secure from the start
  • Set up and harden our immutable cloud infrastructure as a base layer of security
  • Implement automated defense and detection at the operating system and container level
  • Work with Software Engineers to ensure that frontend and backend application code is secure against various types of attacks
  • Implement and manage security tools such as scanners to help keep infrastructure, operating systems, containers, and applications secure
  • Threat model and penetration test our systems and third party applications, with remediation of issues
  • Advocate and educate engineers and our partners on secure design and implementation
  • Work with partners to document security best practice, including how it meets compliance standards (FISMA, FedRAMP, etc.)

What we’re looking for

  • Previous experience securing a medium or large scale production system
  • Significant experience in one or more of: Cloud security, Linux/Unix OS and container security, web application and API security
  • Experience securing data at rest (encryption) and in transit (SSH and HTTPS)
  • Ability to automate procedural tasks using scripting or coding in Python, Javascript, or Ruby
  • A thoughtful, adaptive, and collaborative mindset
  • Excellent written and verbal communication skills, technical and otherwise
  • Ability to pick up and learn new security, development, and operations skills
  • Ability to explain security best practice to less technical stakeholders
  • Years of experience: 5
  • Education: Bachelor’s Degree
Apply here