Cyber Security Engineering Lead

• Translate Risk Management Framework (RMF) categorization results and applicable security control baselines into implementable and testable system security requirements allocated across hardware, software, and networks.
• Develop and maintain security artifacts/documentation, authorization boundary diagrams, data flow diagrams, hardware/software lists, and PPSM registrations.
• Analyze ACAS/Nessus and STIG/SCAP results and assist system administrators with resolving failed security controls and mitigating identified vulnerabilities.
• Provide full Assessment & Authorization (A&A) support and technical security guidance in all phases of the system authorization process and/or Risk Management Framework (RMF)
• Support STIG implementation, compliance verification, and audit readiness.
• Provide security-focused insights and technical support for network, infrastructure, and system architecture.
• Translate and communicate technical risks and requirements between technical and non-technical stakeholders
• Collaborate with cross-functional engineering teams to design, implement, and sustain secure system architectures across the development and delivery lifecycle.
• Interpret and explain vulnerability scan results (e.g., from Nessus, Security Center) to technical teams.
• Identify remediation strategies through configuration, design changes, or process updates.
• Recommend and assist in implementing corrective actions to address failed RMF controls and findings.
• Maintain and administer cybersecurity tools such as Nessus, Tenable Security Center, Evaluate-STIG.
• Embed security into engineering processes, design reviews, configuration baselines, and build pipelines.

• Bachelor’s degree in Cybersecurity, Computer Science, Information Technology, or a related field (will consider relevant experience in lieu of a degree) and 8+ years of cybersecurity engineering experience.
• Must have an active Top Secret/SCI clearance to start.
• US Citizenship is required.
• Working knowledge of NIST SP 800-53 Rev 5, NIST SP 800-37, CNSSI 1253, DISA STIGs and SRGs, as well as familiarization with eMASS and/or XACTA.
• Demonstrated experience carrying systems through a full Risk Management Framework (RMF) authorization cycle; Categorization through Authority to Operate (ATO) and into Continuous Monitoring.
• Experienced in hardening operating systems (Windows Server, RHEL/Linux) and applications to align with STIG requirements and compliance obligations.
• Proficient in security toolsets, including vulnerability assessment platforms (Nessus/Tenable Security Center, ACAS), SIEM platforms, and endpoint security tooling.
• Strong documentation skills, specifically as it relates to generating security documentation in support of the system authorization process.
• Exceptional problem-solving abilities with a proactive approach to identifying and mitigating security risks.
• Demonstrated expertise in cybersecurity engineering activities, including cybersecurity analysis, vulnerability assessments, risk assessments, and remediation efforts.
• Certifications: Security+ and either Linux+ or Microsoft Certified Technology Specialist (MCTS); capable of performing at Information Assurance Technical Level II as per DoD 8140 guidelines.
• Proficient in security toolsets, such as vulnerability assessment tools (e.g., Nessus, Qualys), intrusion detection systems, and SIEM platforms.
• Knowledge of compliance frameworks, such as NIST, JSIG, and DAAPM, and the ability to implement security controls in alignment with these standards.
• Ability to work independently and within a team, adapting to dynamic security challenges.

Desired:

• Advanced certifications, such as CISSP, CEH, or Certified Cloud Security Professional (CCSP).
• Familiarity with DevSecOps practices and integrating security into CI/CD pipelines.
• Container and Kubernetes security experience; familiarity with Iron Bank or Platform One.
• Understanding of data encryption techniques, FIPS 140-3 validated implementations, and secure data handling practices.
• Prior experience on the assessment side (Security Control Assessor, IV&V, or Navy Qualified Validator).