Information Systems Security Engineer

About the role

The Information Systems Security Engineer will lead cybersecurity efforts for complex software projects within a United States Department of Defense (DoD) environment, with a strong focus on Risk Management Framework (RMF) compliance and secure cloud-based workloads. This role drives the creation, submission, and maintenance of security packages and authorizations, including obtaining and sustaining Authorization to Operate (ATO) for Amazon Web Services (AWS) container-based solutions. The position requires deep expertise in DoD cybersecurity processes, tools, and standards, as well as strong communication and collaboration skills across engineering, cybersecurity, business, and customer stakeholders.

The role focuses on securing DoD and cloud-based software workloads, particularly AWS-deployed container environments, using a range of cybersecurity tools, frameworks, and industry standards. You will work closely with engineering, cybersecurity, business, and customer stakeholders in a collaborative setting that values clear communication and thorough documentation. The environment emphasizes adherence to DoD RMF, STIG requirements, and ATO processes, and makes extensive use of tools such as eMASS, STIG Viewer, SonarQube, Trivy, Wiz, eMASSter, Splunk, CloudWatch, and AWS security services like Security Hub and GuardDuty. The position supports a culture of continuous improvement in security posture, integration with DevSecOps practices, and proactive monitoring and vulnerability management across deployed workloads.

Job Type: Contract. Location: Columbia, MD. Workplace Type: Hybrid.

Responsibilities

• Serve as an Information Systems Security Engineer (ISSE) for DoD software projects, providing cybersecurity leadership and guidance across the full system lifecycle.
• Generate and submit complete System Security Packages (SSPs), Plans of Action and Milestones (POA&Ms), and other required artifacts to support DoD Risk Management Framework (RMF) and Security Technical Implementation Guide (STIG) processes.
• Apply DoD cybersecurity tools, including eMASS and STIG Viewer, to build, manage, and validate security packages and supporting documentation.
• Obtain and maintain at least one DoD Authorization to Operate (ATO) for AWS-deployed container-based workloads, ensuring ongoing compliance with DoD security requirements.
• Inform and define software mitigation requirements based on results from static application security testing (SAST) tools such as SonarQube and container scanning tools such as Trivy.
• Recommend and validate data protection mechanisms, including encryption and access control strategies, to safeguard sensitive information in deployed workloads.
• Test and verify security controls to ensure they function as designed and effectively reduce risk across applications and infrastructure.
• Conduct threat modeling activities to identify potential attack vectors and prioritize security mitigations for software systems and cloud workloads.
• Lead vulnerability management activities, including identifying, tracking, and coordinating remediation of security findings across development and operations teams.
• Monitor the security posture of deployed workloads, leveraging appropriate tools and processes to detect and respond to anomalous or malicious activity.
• Collaborate effectively with engineering, cybersecurity, business, and customer stakeholders throughout the RMF cybersecurity lifecycle, ensuring clear communication of risks, requirements, and progress.
• Provide security guidance and input to DevSecOps teams across multiple software releases, helping integrate security best practices into continuous integration and deployment processes.
• Use system security tools such as Wiz or eMASSter to support security posture assessment, reporting, and ongoing compliance activities.
• Contribute to the design and operation of Security Operations Center (SOC) functions, using tools such as Splunk or CloudWatch to support monitoring and incident response.
• Leverage AWS security services, including Security Hub and GuardDuty, to strengthen detection, response, and compliance capabilities in cloud environments.
• Apply knowledge of CIS benchmarks and other industry security standards to align system configurations and controls with recognized best practices.
• Support or coordinate activities related to penetration testing, fuzz testing, and dynamic application security testing (DAST), and use results to drive remediation and improvement.
• Document security requirements, decisions, and outcomes clearly and comprehensively to support audits, assessments, and continuous improvement.

Skills

• At least 5 years of experience serving as an Information Systems Security Engineer (ISSE) for United States Department of Defense (DoD) software projects.
• Proven experience generating and submitting System Security Packages (SSPs), Plans of Action and Milestones (POA&Ms), and other artifacts required for DoD Risk Management Framework (RMF) and Security Technical Implementation Guide (STIG) processes.
• Hands-on experience applying DoD cybersecurity tools such as eMASS and STIG Viewer to develop and manage security packages.
• Demonstrated success obtaining and maintaining at least one DoD Authorization to Operate (ATO) for an AWS-deployed container-based workload.
• Strong background in cyber security, including threat modeling, vulnerability management, security monitoring, and data protection for deployed workloads.
• Experience informing software mitigation requirements based on output from static application security testing (SAST) tools such as SonarQube.
• Experience using container scanning tools such as Trivy to identify and remediate vulnerabilities in containerized workloads.
• Demonstrated expertise in recommending and validating data protections and testing security controls for complex systems.
• Track record of effective communication and collaboration throughout the RMF cybersecurity lifecycle with engineering, cybersecurity, business, and customer stakeholders.
• Possession of one or more relevant cybersecurity certifications, such as CISSP, CASP, or Security+.
• Experience with United States Intelligence Community (IC) system cybersecurity processes and tools.
• Background in establishing or operating Security Operations Center (SOC) functions, including use of tools such as Splunk or CloudWatch