Zero Trust Application Advisor

Description

Pueo is known for bringing the best talent and unique tools to every opportunity. Pueo's Parliament (aka workforce) is composed of professionals who are seeking the opportunity to work in a business organization that thrives on career development and independence. In support of mission and professional growth, our Parliament has supported the development of multiple patents, proprietary tools, and applications as well as trademarked processes.

Our organization emphasizes career development across multiple career environments (at the members own pace) and ensures those who contribute broadly are properly rewarded. Pueo has four career environments where every member of the parliament can participate. Each environment has opportunities available for all levels. Opportunities are framed by an employee's desires and capabilities, and we ensure challenges, growth, and unique experiences are available for employees at all levels.

Our Career Environments (Program, Functional, Service, and Leadership) provide numerous opportunities for employees to invest in their personal growth and those things that offer fulfillment. We invest in helping our members create and execute their career development plans. Our Pods (small teams of 5 or less) are comprised of personnel with similar skillsets to ensure mentorship, understanding, and peer support.   

POSITION SUMMARY

The Zero Trust Application Advisor serves as a principal technical liaison, application domain expert, and technical advisor supporting the CIO’s Zero Trust Program and the wider Defense Intelligence Enterprise. This role is dedicated to partnering with and shepherding application owners through the Zero Trust landscape and functional requirements by explaining the "what" and the "why" to articulating the security intent and clarifying exactly what must be done to meet issued Zero Trust functional requirements and protocols before applications enter formal accreditation and onboarding to the JWICS network. The Advisor does not govern applications or dictate implementation timelines and mechanics, leaving the "how" (engineering design and technology selection) and the "when" (development schedule and release planning) to the respective application teams.   The Advisor does not code, script, implement solutions, govern application roadmaps, or dictate technology choices, engineering methods, schedules, or releases; application teams retain those responsibilities. 

KEY RESPONSIBILITIES

• Guide application owners through pre-accreditation readiness, explaining mandatory functional criteria, compliance evidence, and submission gates. 
• Review architectures, data flows, API specifications, interfaces, and identity integrations against CIO-issued ZT requirements, the DoD ZT Reference Architecture, and IC security baselines; document gaps and actionable advisory findings. 
• Translate ZT objectives into developer-ready functional requirements, acceptance criteria, and checklists covering workload identity, mTLS, API security, least privilege, and continuous verification. 
• Recommend architectural alternatives, interim mitigations, compensating controls, and technical workarounds for legacy, proprietary, or third-party constraints without implementing changes. 
• Build relationships with application owners, developers, architects, and program managers; facilitate technical exchanges, workshops, and readiness reviews to resolve integration challenges and connect delivery teams with enterprise cyber leadership. 
• Coordinate alignment with enterprise identity, device/workload posture, data tagging and protection, network segmentation, and telemetry/SIEM services; advise on common controls and inherited capabilities to reduce RMF/ATO preparation burden. 
• Escalate persistent architecture bottlenecks, ambiguous requirements, and unresolved integration risks to senior ZT architects and program leadership with recommended actions. 

Application and Workload Pillar Focus 

• Identity and access: Workload identity and attestation (e.g., SPIFFE/SPIRE), mTLS, secure credentials, PBAC/ABAC, and continuous request/API verification. 
• API interoperability: Gateway integration, token and schema validation, rate limiting, and secure REST/gRPC exchanges across JWICS enclaves. 
• Secure delivery: DevSecOps security checks, vulnerability mitigation, and software-component transparency for JWICS readiness. 

Knowledge 

• ZT principles and federal guidance: NIST SP 800-207, OMB M-22-09, DoD ZT Strategy and Reference Architecture, and CISA ZT Maturity Model. 
• Application architecture and development concepts: microservices, containers, APIs, and cloud/hybrid patterns; JWICS and IC/DoD compliance requirements, including NIST SP 800-37/800-53 and ICD 503. 
• Identity and cryptography: PKI, certificate authentication, mTLS, OAuth2, OIDC, SAML, and non-person entity credentials. 
• Skills 
• Evaluate application designs, explain compliance expectations, and recommend practical architectural alternatives or compensating controls. 
• Translate mandates into functional requirements, acceptance criteria, checklists, and clear technical guidance; facilitate consensus among developers, owners, and leadership. 
• Abilities 
• Guide and influence teams without controlling implementation or schedules; explain security intent to technical and program audiences. 
• Identify architecture, legacy-system, and protocol gaps early while coordinating numerous concurrent pre-accreditation engagements. 

EDUCATION AND EXPERIENCE

• Bachelor’s Degree (for Senior level) or Master’s Degree (for Expert level) in Software Engineering, Cybersecurity, Information Systems, Systems Engineering, or a related technical discipline. 
• Experience 
• 12+ years in enterprise cybersecurity, application architecture, systems engineering, or technical advisory roles in federal, DoD, or IC environments. 
• 5+ years of prior software development, application engineering, DevSecOps, or software architecture experience supporting design reviews and developer guidance; no hands-on engineering in this role. 
• 3+ years advising on ZT, ICAM integration, secure APIs, micro-segmentation, or application readiness for classified or enterprise federal networks. 
• Demonstrated success leading technical engagements, building developer buy-in, and guiding multiple teams through technical requirements. 

PREFERRED CERTIFICATIONS 

• Cybersecurity/Architecture: CISSP, CSSLP, CASP+ CE, CCZT, or CASS. 
• Cloud/Platform: AWS Solutions Architect or Security Specialty, Microsoft Cybersecurity Architect Expert (SC-100), CKA/CKS, or Red Hat OpenShift credentials. 

CLEARANCE

• Current/Active Top Secret (TS) clearance with SCI eligibility. 
• Ability to pass a Counterintelligence (CI) Polygraph examination.