Cybersecurity Engineer

• Implement and maintain required NIST security controls in accordance with the approved baseline across all platform environments

• Integrate Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), Software Composition Analysis (SCA), container scanning, and Infrastructure as Code scanning into CI/CD pipelines

• Ensure vulnerabilities identified through scanning are remediated within Government-defined timelines

• Enforce secure coding standards and approved dependency management practices across all platform development activities

• Implement and maintain Zero Trust Architecture principles and least-privilege access controls across all platform components and tenant boundaries

• Configure and manage container security including image signing, vulnerability scanning, runtime protection, and registry security

• Implement and operate centralized secrets management ensuring automated rotation for 100% of production secrets where automation is supported

• Support zero-trust and least-privilege principles in pipeline and deployment configurations

• Validate security control effectiveness through automated testing, configuration validation, and periodic assessments

• Support penetration testing, red team activities, and independent security assessments as required

• Implement and maintain encryption in transit and at rest across all platform data flows, storage, and backup assets using FIPS 140-3 validated cryptographic modules

• Configure and manage independent per-region KMS keys for multi-region deployments ensuring a compromise in one region does not affect data confidentiality in the other

• Support cybersecurity incident response activities in coordination with VA security operations including forensic analysis, root cause determination, and corrective action planning

• Implement and maintain firewall configurations, security group definitions, and network access controls in accordance with VA security policies

• Support continuous monitoring activities including configuration validation, security event correlation, and anomaly detection

• Ensure all platform components comply with VA Critical Security Controls and are authorized for use prior to connection to the VA network

• Support FICAM requirements including PIV-based authentication, automated provisioning, and Identity/Authenticator/Federation Assurance Level compliance

• Contribute to security documentation including Security Impact Assessments, Information System Vulnerability Management Plans, Security Assessment Plans, and Security Assessment Reports

• Participate in security audits and assessments providing technical evidence, documentation, and remediation support

• Participate in Agile and SAFe ceremonies including sprint planning, backlog refinement, demos, and retrospectives

• Demonstrated experience in cybersecurity engineering for complex, mission-critical cloud platforms in Federal or enterprise environments

• Hands-on experience implementing security controls in AWS cloud environments including EKS, IAM, KMS, security groups, VPC security, and encryption services

• Experience integrating SAST, DAST, SCA, and container scanning tools into CI/CD pipelines

• Deep knowledge of Zero Trust Architecture principles and implementation practices

• Experience with container security including image scanning, runtime protection, and Kubernetes security policies

• Hands-on experience with secrets management tools (AWS Secrets Manager, HashiCorp Vault, Kubernetes secrets)

• Knowledge of FIPS 140-3 cryptographic requirements and their implementation in cloud environments

• Experience with NIST SP 800-53 Rev. 5 security controls implementation and validation

• Familiarity with penetration testing, red team methodologies, and vulnerability remediation practices

• Experience with incident response including forensic analysis, evidence collection, and corrective action development

• Knowledge of Federal identity and access management requirements including FICAM, PIV, and multi-factor authentication

• Experience with firewall configuration, network security, and secure external connections in Federal cloud environments

• Knowledge of HIPAA, Privacy Act, FISMA, and Federal data protection requirements

• Experience working in Agile or SAFe environments with sprint-based delivery cadences

• CISSP, CEH, GIAC, or equivalent cybersecurity certification required

• AWS Security Specialty or equivalent cloud security certification preferred

• Certified Kubernetes Security Specialist (CKS) or equivalent certification preferred

• Bachelor’s Degree from an accredited academic institution with a minimum of 5 years of experience in cybersecurity engineering, with at least 2 years implementing security controls for cloud-native platforms in Federal or enterprise IT environments

• OR

• Associate’s Degree from an accredited academic institution with a minimum of 7 years of experience in cybersecurity engineering, with at least 3 years implementing security controls for cloud-native platforms in Federal or enterprise IT environments

• Plus:

• Department of Veterans Affairs (VA) experience

• Active Personal Identity Verification (PIV) card

• Experience with VA Critical Security Controls and VA Handbook 6500 security requirements

• Experience implementing security controls across multi-tenant authorization boundaries

• Experience with VA-specific security tools and governance processes including SNOWCAM, TRM, and BPE, * cybersecurity engineering: 5 years (Required)

Up to $150,000 a year - Full-time, Contract