Pay Growth
?
out of 5
Not enough data
Not enough info to score pay or growth
Senior API Security Engineer
Job
ECS
Falls Church, VA (In Person)
Full-Time
Review key factors to help you decide if the role fits your goals.
Job Security
?
out of 5
Not enough data
Calculating job security score...
Total Score
74
out of 100
Average of individual scores
Skill Insights
Compare your current skills to what this opportunity needs—we'll show you what you already have and what could strengthen your application.
Job Description
Job Requirements Falls Church, VA Secret Polygraph Unspecified Career Level not specified Salary not specified Join Premium to unlock estimated salaries Job Description Job Description Everforth ECS is seeking a Senior API Security Engineer to work in the National Capital Region covering the Pentagon, Falls Church, and Fairfax .
Please Note:
This position is contingent upon contract award. The War Data Platform (WDP) is a key initiative within the U.S. Department of War's (DoW) AI-First strategy introduced in early 2026. The WDP focuses on operational warfighting data and aims to accelerate the deployment of artificial intelligence (AI) on the battlefield. The WDP extends to Unclassified, Secret, and Top Secret environments, and supports collaboration between Combatant Commands, Joint Staff directorates, Senior Executive Service leaders, and operational analysts. This role validates boundary controls for AI and machine-learning model APIs, proxy configurations, and external-model connectivity patterns within WDP Core Integration serving environments, applying enterprise API security methodologies to maintain mission assurance posture and operational readiness across all classification enclaves.- Validates boundary controls for artificial intelligence and machine-learning model APIs, proxy configurations, and external-model connectivity patterns within War Data Platform (WDP) Core Integration serving environments supporting Department of War missions, Joint Staff analysts, Combatant Command elements, and Senior Executive Service leadership.
- Reviews authentication and authorization flows, throttling configurations, policy enforcement logic, and ingress and egress controls governing access to production-ready model endpoints.
- Applies API security methodologies using Kong Gateway, NGINX, Envoy, OAuth2, OpenID Connect, Kubernetes network policies, GitLab Continuous Integration, VMware environments, Elastic Stack, and Prometheus metrics to evaluate operational behavior, detect misconfigurations, and maintain mission assurance posture.
- Conducts structured assessments of external-model integrations-including Amazon Bedrock connectivity patterns-by validating token exchange mechanisms, policy boundaries, and cross-domain access controls aligned with enterprise DevSecOps standards.
- Performs change-approval activities by reviewing configuration updates, validating security impact, and documenting operational risk considerations for deployment pipelines and serving surfaces.
- Produces mission-critical deliverables-including API boundary-control assessments, policy-compliance reports, connectivity-pattern documentation, operational risk evaluations, and change-approval artifacts.
- Collaborates with Platform One, Cloud One, multi-national engineering teams, and cross-service mission partners to strengthen operational readiness, reinforce deployment consistency, and advance program value commitments across all enclaves.
- Supports Tier-4 incident-response actions by providing authoritative API security evidence, boundary-control documentation, and remediation guidance required for operational continuity and sustained mission performance.
- Performs other duties as assigned. Required Skills
- Current Secret security clearance with the ability to obtain and maintain a Top Secret (TS) security clearance with Sensitive Compartmented Information (SCI).
- IAT II-level security certification (CompTIA Security+ CE, CompTIA CySA+, CompTIA Cloud+, Cisco CCNA Security, GIAC
GSEC, GIAC
GCED, or ISC² SSCP).- Minimum 10 years of experience in API security engineering, application security, or cybersecurity engineering roles within classified or federal environments.
- Hands-on experience applying API security methodologies using tools such as Kong Gateway, NGINX, Envoy, OAuth2, OpenID Connect, and Kubernetes network policies to assess operational behavior, identify misconfigurations, and enforce boundary controls in production environments.
- Demonstrated experience conducting structured API security assessments of external-model integrations-including token exchange validation, policy boundary enforcement, and cross-domain access control verification-within enterprise DevSecOps frameworks.
- Strong problem-solving and decision-making capabilities, with a proven ability to weigh the relative costs and benefits of potential actions and identify the most appropriate solution.
- Highly developed interpersonal and oral/written communication skills, with the ability to effectively and professionally interact with a diverse set of stakeholders (from peers to end-users to executive management). Desired Skills
- Active Top Secret (TS) security clearance with Sensitive Compartmented Information (SCI) eligibility.
- Prior experience working within Platform One or Cloud One environments, including familiarity with their pipeline hardening standards, enclave-parity configurations, and artifact-management frameworks as applied to API security governance.
- Demonstrated experience integrating API security controls with observability platforms-such as Elastic Stack and Prometheus-to provide real-time visibility into endpoint behavior, anomaly detection, and cross-domain access patterns.
- Familiarity with Zero Trust architecture principles, including Attribute-Based Access Control (ABAC) and micro-segmentation strategies, as applied to AI/ML model-serving API surfaces across NIPRNet, SIPRNet, and JWICS environments.
- Experience authoring and maintaining change-approval documentation, API policy-compliance reports, and operational risk assessments that satisfy DoW RMF and continuous authorization requirements.