About the team
USATII's Federal Security Engineering team is responsible for implementing and validating the security controls required to deploy enterprise software in regulated government environments.
Our work spans application security, cloud infrastructure, identity and access management, secure software development, system monitoring, privacy engineering, and federal authorization support.
DART is USATII's deployment and workforce management platform. It maintains sensitive operational information involving personnel records, qualifications, training, workforce readiness, incidents, deployment assignments, and administrative decisions.
We are developing the technical capabilities, documentation, and operational procedures needed to prepare DART for prospective high-impact federal production environments.
About the role
USATII is seeking Federal Security & ATO Engineers to lead cybersecurity engineering and support the security authorization process for DART.
You will work directly with government cybersecurity personnel, system owners, information-system security officers, technical assessors, and USATII's engineering teams to ensure that DART's security controls are appropriate for its intended federal operating environment.
An initial area of focus is the potential modernization of FEMA's legacy Deployment Tracking System. DART's proposed federal architecture targets AWS GovCloud, with security controls informed by the NIST Risk Management Framework and applicable NIST SP 800-53 requirements.
DART currently implements application-level authentication, role-based access controls, organizational permissions, protected operations, and audit histories. Federal production deployment requires further security engineering, control validation, documentation, independent assessment, and government authorization.
You will be directly responsible for translating these requirements into implemented safeguards and defensible technical evidence.
This is a hands-on security engineering position. You will review architecture, inspect source code, assess infrastructure configurations, develop security controls, coordinate remediation, and work with government stakeholders throughout authorization and production operations.
The role does not independently grant an Authority to Operate. Authorization decisions remain with the designated government authorizing official.
In this role, you will:
-
Lead technical preparation for DART's federal authorization process, including system boundary definition, security categorization support, control implementation, assessment readiness, remediation, and continuous monitoring.
-
Translate applicable NIST SP 800-53 controls and agency-specific security requirements into concrete engineering tasks, technical configurations, verification procedures, and documented evidence.
-
Develop and maintain security documentation, including System Security Plan contributions, network and data-flow diagrams, control implementation statements, configuration baselines, and Plans of Action and Milestones.
-
Evaluate DART's architecture across application services, APIs, databases, authentication systems, background workers, external integrations, cloud infrastructure, administrative interfaces, and security-relevant deployment tooling.
-
Review and strengthen application authorization mechanisms involving personnel records, qualifications, incidents, deployment decisions, organizational permissions, and privileged administrative functions.
-
Implement and validate least-privilege access, separation of duties, account lifecycle controls, session management, service authentication, and protection of sensitive application operations.
-
Support integration with FEMA-approved enterprise identity infrastructure, including applicable MFA, identity federation, privileged access requirements, and PIV/CAC authentication policies.
-
Work with GovCloud Platform Engineers to establish secure network boundaries, encryption, key management, service identities, secrets protection, hardened configurations, and approved external connectivity.
-
Develop technical controls for protecting sensitive personnel information, including access restrictions, auditability, data minimization, controlled exports, retention requirements, and approved transmission mechanisms.
-
Establish application and infrastructure audit requirements covering authentication events, denied access, privileged actions, record changes, integration activity, security configuration changes, and operational investigations.
-
Coordinate vulnerability scanning, software dependency assessments, container security reviews, code analysis, penetration testing, and technical remediation.
-
Maintain security findings, remediation priorities, assigned owners, verification evidence, and risk documentation through a controlled assessment and remediation process.
-
Evaluate third-party dependencies, software components, cloud services, and external integrations for security implications and authorization-boundary effects.
-
Coordinate security control inheritance and shared-responsibility documentation between USATII, cloud providers, specialized subcontractors, and government system owners.
-
Prepare technical evidence for independent security assessors, including implemented configuration details, access-control test results, audit demonstrations, vulnerability findings, and remediation records.
-
Participate in security architecture reviews, government assessment meetings, authorization preparation, and technical discussions with designated security authorities.
-
Develop incident-response procedures covering security alert triage, investigation, evidence preservation, containment, technical recovery, and required escalation.
-
Establish continuous monitoring procedures for vulnerabilities, configuration changes, privileged activity, access-control effectiveness, security events, and recurring control assessments.
-
Work alongside software engineers to resolve vulnerabilities and implement secure engineering patterns that become reusable components of DART's underlying platform.
-
Contribute to security training, operational documentation, and long-term federal security engineering practices.
You might thrive in this role if you:
-
Have 5+ years of professional experience in cybersecurity engineering, security architecture, application security, cloud security, or federal information-system authorization.
-
Have directly implemented or assessed NIST SP 800-53 security controls within enterprise or federal production systems.
-
Understand FISMA, the NIST Risk Management Framework, system authorization boundaries, inherited controls, control assessments, and continuous monitoring.
-
Have participated in a federal ATO effort and contributed technical documentation, assessment evidence, control implementation, or remediation work.
-
Possess substantial hands-on experience assessing software applications, APIs, authentication systems, databases, cloud infrastructure, and network security configurations.
-
Understand identity federation, least-privilege authorization, privileged access controls, multifactor authentication, audit logging, and protection of sensitive government data.
-
Have experience using vulnerability management, source-code analysis, infrastructure scanning, software supply-chain security, or penetration-testing tools.
-
Can independently review software or cloud infrastructure and identify meaningful security weaknesses.
-
Are proficient in Python, TypeScript, Go, or another programming language suitable for security automation and technical investigation.
-
Have experience with AWS security architecture, including IAM, VPC controls, KMS, CloudTrail, security monitoring, and infrastructure configuration management.
-
Can communicate security findings clearly to software engineers, technical program managers, government stakeholders, and security assessors.
-
Are comfortable investigating ambiguous security problems, prioritizing remediation, and maintaining accurate evidence of what has actually been implemented.
-
Can distinguish a documented security policy from an operating technical control and design effective methods of verifying both.
Experience with AWS GovCloud, DHS security requirements, federal high-impact information systems, or previous government authorization efforts is especially valuable.
Relevant certifications such as CISSP, CISM, CCSP, or comparable credentials are beneficial but are not substitutes for demonstrated engineering and authorization experience.
About USATII
USATII is a U.S.-based enterprise software engineering company focused on designing, building, and deploying operational software and private AI systems.
We work directly with organizations to understand complex business processes, develop integrated technology solutions, and support those systems throughout their operational lifecycle.
Our approach emphasizes technical ownership, direct collaboration between engineers and customers, configurable enterprise architectures, and software that organizations can control and sustain over the long term.
USATII is privately held and operates from Rochester, New York, serving commercial and prospective public-sector customers.
USATII is an equal opportunity employer and considers qualified applicants without regard to legally protected characteristics. Reasonable accommodations are available during the application process.
Compensation
The proposed base salary for this position is $120,000 annually.
Additional compensation, employee benefits, and employment terms will be determined through an approved employment offer.
Full-time employment is contingent upon contract award, approved funding, and final program staffing requirements.
Any citizenship, suitability, public-trust, security-clearance, or work-location requirements will be specified when established for the applicable customer engagement.