Tech Lead - Security Remediation Standards

Kforce has a client seeking a remote Tech Lead to join their team. We are seeking a Tech Lead to define and deliver the application security standards used across the BC2 remediation program within Data Engineering. This is a centralized role that translates InfoSec control requirements into executable engineering specifications, establishes hardened reference implementations for each application type in the estate, and validates remediation prior to production implementation. Duties:

• Translate InfoSec control requirements into scoped, assignable engineering work with defined acceptance criteria and audit evidence
• Create and maintain well-defined development tickets with clear requirements and measurable outcomes
• Classify the application estate into a small number of types, based on build and runtime characteristics, and maintain that classification as the estate changes
• Establish, or specify for others to build, the tooling, environments, and pipeline capability required to deliver and validate standards at scale
• Design, build, and maintain a hardened reference implementation for each type
• Define migration paths for end-of-life runtimes and frameworks and identify workloads where retirement or replacement is lower cost than remediation
• Analyze scan findings and exception requests to determine exploitability, identify false positives, and specify compensating controls where remediation is not viable
• Define acceptance criteria and rollback procedures with the accountable application owner prior to production implementation, escalating where ownership is unresolved
• Ensure remediation evidence is generated by the build rather than assembled manually
• Provide technical direction to remediation engineers executing against published standards
• Produce standards documentation, migration procedures, developer guidance, and remediation evidence
• 10+ years of software engineering experience across the full development lifecycle, including Tech Lead roles
• Experience designing and operating CI/CD, build, or developer platform capability adopted at scale across multiple development teams
• Experience in Linux environments; Windows exposure preferred
• Experience delivering in regulated environments with audit and evidence obligations
• Experience in a shared-services or centralized delivery model supporting multiple application teams with competing priorities

• Track record driving adoption of engineering standards across teams outside direct reporting lines
• Container build systems, including base images, multi-stage builds, minimal and hardened images, and the runtime impacts of adoption
• Vulnerability management, including interpreting scanner findings, exploitability and reachability assessment, prioritization, compensating controls, and exception documentation
• Working proficiency in Java, .NET, and Python sufficient to specify and review code changes
• Test strategy for request-serving services and for batch and pipeline workloads, including output-correctness verification
• Cloud platform depth in AWS or Azure
• CI/CD tooling and pipeline automation, such as Jenkins, GitHub Actions, GitLab, or equivalent
• Infrastructure as code, such as Terraform, Ansible, or equivalent