Security Engineer

About Corbalt Corbalt is a technology company that partners with federal agencies to modernize and operate complex technology ecosystems. We build shared platforms, engineering foundations, and reusable services that enable mission teams to deliver software faster, operate more efficiently, and scale with confidence. Our roots trace back to the Healthcare.gov recovery effort, where we saw firsthand what talented, mission-driven teams could accomplish together. That experience shaped how we work today: solving complex technical challenges through collaboration, pragmatic engineering, and a relentless focus on delivering value. Today, we support critical healthcare modernization efforts at the Centers for Medicare & Medicaid Services (CMS), helping build and operate the platforms, tools, and services that enable teams across Medicare and Medicaid to deliver secure, resilient digital experiences. We’re a remote-first team that values curiosity, kindness, ownership, and continuous learning. We enjoy solving hard technical problems, partnering closely with our clients, and building technology that makes government work better for the people who rely on it. Contingent Position: This position is contingent upon Corbalt’s successful contract award. Employment offers and start dates are dependent on the award of the associated government contract. Security Engineer We’re looking for a Security Engineer who enjoys building secure software, improving engineering platforms, and helping teams deliver with confidence. You’ll work closely with software engineers to integrate security into the development lifecycle, automate security practices, and build resilient cloud-native systems that support critical government services. Responsibilities Integrate security into the software development lifecycle through automation, testing, and continuous improvement. Identify, investigate, and remediate application and infrastructure vulnerabilities. Develop tools and automation in Python, Go, or Terraform that improve security, developer productivity, and operational visibility (it’s not important that you know these languages). Support security assessments, compliance activities, and continuous monitoring. Contribute to security best practices across engineering teams. Skills Strong software engineering fundamentals and experience writing production code. Experience with application security, DevSecOps, or cloud security. Understanding of secure software design, authentication/authorization, and common application vulnerabilities. Familiarity with at least one commonly used programming language and one infrastructure-as-code language. Strong communication and collaboration skills with engineering and technical stakeholders. Experience 3+ years of engineering experience Demonstrated ability to operate independently and ramp quickly in complex environments Experience supporting security assessments, compliance, or continuous monitoring in regulated environments Familiarity with federal cloud and security requirements (e.g., FISMA) Demonstrated experience operating and analyzing systems in AWS, Azure, or Google Cloud. Values Growth-oriented mindset Intrinsic motivation to learn, grow, and do great work Kindness Grit / perseverance / resilience Compensation & Benefits The base salary range for this position is: $138,677 - $182,296 per year. In addition to the base salary, Corbalt offers: Medical, dental, vision benefits Profit sharing and discretionary bonuses A company 401(k) contribution equal to 3% of your salary Paid vacation, sick time, and company holidays Reimbursement for reasonable expenses that are helpful for work In-person company retreats Hiring Process The first stage is an informal conversation to learn more about each other, answer questions, and discuss the role. The second stage is a mini-project based on something we’ve actually worked on. The goal of this is to get an idea of what working together is like. The last stage is: a 10-20 minute presentation to the team describing what you did on a previous project and two 30 minute conversations with other people on the team to get an additional perspective on what our work is like. Other Requirements Due to contractual requirements applicants must: Be authorized to work in the United States Currently reside in the United States or its territories Have resided in the United States or its territories for three of the last five years Have at least three years of professional experience Due to contractual and security requirements, all work must be performed while physically present within the United States or its territories. Work performed while outside the U.S. or its territories is strictly forbidden. Corbalt participates in E-Verify. Upon hire, your Form I-9 information will be provided to the federal government to confirm you are authorized to work in the United States. Corbalt is an Equal Opportunity Employer, including disability and protected veteran status. We may use artificial intelligence (AI) tools to support parts of the hiring process, such as reviewing applications, analyzing resumes, or assessing responses and identifying potential inconsistencies or verification signals in application materials based on available information. These tools assist our recruitment team but do not replace human judgment. Final hiring decisions are ultimately made by humans. If you would like more information about how your data is processed, please contact us.