Information Systems Security Engineer
Responsibilities
- Develops, implements, and maintains security solutions for complex systems to ensure confidentiality, integrity, and availability.
- Conducts system security analysis, risk assessments, and vulnerability assessments to identify and mitigate risks.
- Supports the development of security architecture and system security engineering artifacts based on NIST, DoD, and IC policies and guidelines.
- Collaborates with system architects, software engineers, and network engineers to incorporate security requirements into system design.
- Develops and maintains System Security Plans (SSPs), Security Assessment Reports (SARs), and related Risk Management Framework (RMF) documentation.
- Performs continuous monitoring and ensures compliance with applicable security standards (NIST SP 800-53, ICD 503, CNSS, etc.).
- Provides recommendations for improving system security posture and addresses security incidents as they arise.
- Engages in security testing, evaluation, and certification & accreditation (C&A) activities.
- Interfaces with government customers and stakeholders to effectively communicate technical information and security strategies.
Requirements
With some or all of the following security frameworks and standards such as NIST SP 800-53, RMF, ICD 503, CNSS, DoD STIGs
Security tools such as ACAS, Nessus, Tenable, Splunk, Wireshark, HBSS, McAfee ePO
Security technologies including Firewalls, IDS/IPS, SIEMs, VPNs, PKI, Multi-Factor Authentication
System security documentation: SSPs, POA&Ms, SARs, Security Control Traceability Matrix (SCTM)
Experience with Linux, Unix, Windows, and Virtualization technologies (VMware, Hyper-V)
Cloud platforms such as AWS, Azure, Google Cloud with a focus on cloud security
Encryption protocols and technologies such as TLS/SSL, IPsec, VPN, PKI
Security testing tools: Nmap, Metasploit, Burp Suite, Kali Linux
Scripting and automation experience: Python, PowerShell, Bash
Knowledge of system development lifecycle (SDLC), software assurance, and secure coding practices
Certifications such as CISSP, CAP, CEH, Security+, AWS Security Specialty, or equivalent