Everforth ECS is seeking a Senior API Security Engineer to work in the National Capital Region covering the Pentagon, Falls Church, and Fairfax. Please Note: This position is contingent upon contract award.

The War Data Platform (WDP) is a key initiative within the U.S. Department of War's (DoW) AI-First strategy introduced in early 2026. The WDP focuses on operational warfighting data and aims to accelerate the deployment of artificial intelligence (AI) on the battlefield. The WDP extends to Unclassified, Secret, and Top Secret environments, and supports collaboration between Combatant Commands, Joint Staff directorates, Senior Executive Service leaders, and operational analysts.

This role validates boundary controls for AI and machine-learning model APIs, proxy configurations, and external-model connectivity patterns within WDP Core Integration serving environments, applying enterprise API security methodologies to maintain mission assurance posture and operational readiness across all classification enclaves.

• Validates boundary controls for artificial intelligence and machine-learning model APIs, proxy configurations, and external-model connectivity patterns within War Data Platform (WDP) Core Integration serving environments supporting Department of War missions, Joint Staff analysts, Combatant Command elements, and Senior Executive Service leadership.
• Reviews authentication and authorization flows, throttling configurations, policy enforcement logic, and ingress and egress controls governing access to production-ready model endpoints.
• Applies API security methodologies using Kong Gateway, NGINX, Envoy, OAuth2, OpenID Connect, Kubernetes network policies, GitLab Continuous Integration, VMware environments, Elastic Stack, and Prometheus metrics to evaluate operational behavior, detect misconfigurations, and maintain mission assurance posture.
• Conducts structured assessments of external-model integrations—including Amazon Bedrock connectivity patterns—by validating token exchange mechanisms, policy boundaries, and cross-domain access controls aligned with enterprise DevSecOps standards.
• Performs change-approval activities by reviewing configuration updates, validating security impact, and documenting operational risk considerations for deployment pipelines and serving surfaces.
• Produces mission-critical deliverables—including API boundary-control assessments, policy-compliance reports, connectivity-pattern documentation, operational risk evaluations, and change-approval artifacts.
• Collaborates with Platform One, Cloud One, multi-national engineering teams, and cross-service mission partners to strengthen operational readiness, reinforce deployment consistency, and advance program value commitments across all enclaves.
• Supports Tier-4 incident-response actions by providing authoritative API security evidence, boundary-control documentation, and remediation guidance required for operational continuity and sustained mission performance.
• Performs other duties as assigned.