Principal Cyber Protection/Sr. Principal Engineer (AHT)

Relocation assistance may be available. This position requires an active Top Secret clearance and travel up to 10% of the time.

About the role

Northrop Grumman Defense Systems (NGDS) is seeking a Cyber Protection Principal Engineer to maintain and enhance capabilities in support of DAF CLOUDworks at the Air Force Research Lab (AFRL) in Rome, NY, Warner Robins, GA, or Wright Patterson Air Force Base, OH. DAF CLOUDworks is a rapidly growing secure cloud program encompassing 10+ teams spanning cloud engineering areas including information security, infrastructure development, and cloud migration.

You will be an active part of one of these teams providing technical support of customers leveraging DAF CLOUDworks. The role focuses on cloud penetration testing, adversarial emulation, red team operations, and container security assessments within a cleared DoD environment. The ideal candidate has a strong offensive security background and deep expertise in AWS and Azure environments. This position is contingent on customer funding and approval and may be filled at a level 3 or level 4.

Responsibilities

• Perform cloud penetration testing, adversarial emulation, and red team operations
• Conduct container security assessments in a cleared DoD environment
• Modify and enhance cloud offerings to implement new requirements, improve functionality, increase efficiency, or lower operating/deployment costs
• Utilize cloud-native offensive tooling including Pacu, AADInternals, ScoutSuite, CloudFox, Prowler, and ROADtools
• Document findings and communicate risk to technical teams and senior leadership
• Develop and execute cyber tabletop exercises, including threat scenario design and after-action reporting
• Work with Jira and Confluence for sprint and documentation workflows, and GitHub for version-controlled tooling and collaborative code review

Requirements

• Active Top Secret/SCI clearance (required for start)
• Ability to obtain an IAT Level II or III certification (e.g., Security+, Pentest+, SecurityX) within 60 days of start
• Deep knowledge of cloud attack paths, including IAM privilege escalation, metadata service abuse, misconfigured storage, cross-account trust exploitation, and OAuth/token abuse
• Proficiency with cloud-native offensive tooling (Pacu, AADInternals) and enumeration platforms (ScoutSuite, CloudFox, Prowler, ROADtools)
• Strong scripting skills in Bash, Python, and PowerShell
• Working knowledge of MITRE ATT&CK as applied to cloud and hybrid environments

Qualifications

Level 3: Bachelor’s degree in Science with 5+ years of software development experience; Master's with 3+ years of relative experience; or an additional 4 years of experience in lieu of degree.

Level 4: Bachelor’s degree in Science with 8+ years of software development experience; Master's with 6+ years of relative experience; or an additional 4 years of experience in lieu of degree.

Preferred Qualifications

• Prior DoD or IC classified environment experience
• Familiarity with adversary simulation platforms such as Cobalt Strike, Sliver, or Havoc
• Hands-on experience with Docker and Kubernetes security assessments, including container escape techniques, privileged container abuse, K8s RBAC misconfigurations, and CI/CD pipeline security (GitLab, GitHub Actions, Jenkins)
• Preferred certifications: OSCP, CPTS, PNPT, GPEN, GXPN, GCPN, AWS Security Specialty, or AZ-500

Pay

Primary Level Salary Range: $98,400.00 - $155,400.00

Secondary Level Salary Range: $122,800.00 - $193,900.00

Base salary offers consider scope, responsibilities, experience, education, skills, and market conditions. Eligible employees may receive overtime, shift differential, discretionary bonuses, annual performance-based bonuses, and long-term incentives (for VP/Director roles).

Benefits

• Health insurance coverage
• Life and disability insurance
• Savings plan
• Company-paid holidays
• Paid time off (PTO) for vacation and personal business