Job Type
Full-time
Description
POSITION SUMMARYThe Zero Trust Application Advisor serves as a principal technical liaison, application domain expert, and technical advisor supporting the CIO's Zero Trust Program and the wider Defense Intelligence Enterprise. This role is dedicated to partnering with and shepherding application owners through the Zero Trust landscape and functional requirements by explaining the "what" and the "why" to articulating the security intent and clarifying exactly what must be done to meet issued Zero Trust functional requirements and protocols before applications enter formal accreditation and onboarding to the JWICS network. The Advisor does not govern applications or dictate implementation timelines and mechanics, leaving the "how" (engineering design and technology selection) and the "when" (development schedule and release planning) to the respective application teams. The Advisor does not code, script, implement solutions, govern application roadmaps, or dictate technology choices, engineering methods, schedules, or releases; application teams retain those responsibilities.
KEY RESPONSIBILITIES- Guide application owners through pre-accreditation readiness, explaining mandatory functional criteria, compliance evidence, and submission gates.
- Review architectures, data flows, API specifications, interfaces, and identity integrations against CIO-issued ZT requirements, the DoD ZT Reference Architecture, and IC security baselines; document gaps and actionable advisory findings.
- Translate ZT objectives into developer-ready functional requirements, acceptance criteria, and checklists covering workload identity, mTLS, API security, least privilege, and continuous verification.
- Recommend architectural alternatives, interim mitigations, compensating controls, and technical workarounds for legacy, proprietary, or third-party constraints without implementing changes.
- Build relationships with application owners, developers, architects, and program managers; facilitate technical exchanges, workshops, and readiness reviews to resolve integration challenges and connect delivery teams with enterprise cyber leadership.
- Coordinate alignment with enterprise identity, device/workload posture, data tagging and protection, network segmentation, and telemetry/SIEM services; advise on common controls and inherited capabilities to reduce RMF/ATO preparation burden.
- Escalate persistent architecture bottlenecks, ambiguous requirements, and unresolved integration risks to senior ZT architects and program leadership with recommended actions.
Application and Workload Pillar Focus - Identity and access: Workload identity and attestation (e.g., SPIFFE/SPIRE), mTLS, secure credentials, PBAC/ABAC, and continuous request/API verification.
- API interoperability: Gateway integration, token and schema validation, rate limiting, and secure REST/gRPC exchanges across JWICS enclaves.
- Secure delivery: DevSecOps security checks, vulnerability mitigation, and software-component transparency for JWICS readiness.
Knowledge - ZT principles and federal guidance: NIST SP 800-207, OMB M-22-09, DoD ZT Strategy and Reference Architecture, and CISA ZT Maturity Model.
- Application architecture and development concepts: microservices, containers, APIs, and cloud/hybrid patterns; JWICS and IC/DoD compliance requirements, including NIST SP 800-37/800-53 and ICD 503.
- Identity and cryptography: PKI, certificate authentication, mTLS, OAuth2, OIDC, SAML, and non-person entity credentials.
- Skills
- Evaluate application designs, explain compliance expectations, and recommend practical architectural alternatives or compensating controls.
- Translate mandates into functional requirements, acceptance criteria, checklists, and clear technical guidance; facilitate consensus among developers, owners, and leadership.
- Abilities
- Guide and influence teams without controlling implementation or schedules; explain security intent to technical and program audiences.
- Identify architecture, legacy-system, and protocol gaps early while coordinating numerous concurrent pre-accreditation engagements.
EDUCATION AND EXPERIENCE- Bachelor's Degree (for Senior level) or Master's Degree (for Expert level) in Software Engineering, Cybersecurity, Information Systems, Systems Engineering, or a related technical discipline.
- Experience
- 12+ years in enterprise cybersecurity, application architecture, systems engineering, or technical advisory roles in federal, DoD, or IC environments.
- 5+ years of prior software development, application engineering, DevSecOps, or software architecture experience supporting design reviews and developer guidance; no hands-on engineering in this role.
- 3+ years advising on ZT, ICAM integration, secure APIs, micro-segmentation, or application readiness for classified or enterprise federal networks.
- Demonstrated success leading technical engagements, building developer buy-in, and guiding multiple teams through technical requirements.
PREFERRED CERTIFICATIONS - Cybersecurity/Architecture: CISSP, CSSLP, CASP+ CE, CCZT, or CASS.
- Cloud/Platform: AWS Solutions Architect or Security Specialty, Microsoft Cybersecurity Architect Expert (SC-100), CKA/CKS, or Red Hat OpenShift credentials.
CLEARANCE- Current/Active Top Secret (TS) clearance with SCI eligibility.
- Ability to pass a Counterintelligence (CI) Polygraph examination.
