Senior Information Security Engineer

The Digital Sector at Leidos currently has an opening for a Senior Information Security Engineer to support the Department of Veterans Affairs’ Office of Information & Technology (OIT). In this contract, Leidos assists with the underlying infrastructure, tools, and operational services used to build, deploy, secure, and run VA health applications.

The Senior Information Security Engineer plays a critical role in advancing cybersecurity operations for mission-critical Federal cloud environments by leading RMF activities, ATO/ATC efforts, security assessments, continuous monitoring, vulnerability management, and risk remediation. This position develops and maintains key security documentation, supports audits and authorization activities, and drives the implementation of security governance, incident response, and access control practices in alignment with Federal cybersecurity requirements and NIST standards.

The selected candidate will:

• Support all six steps of the NIST RMF lifecycle and develop/maintain required RMF documentation and security diagrams
• Prepare, submit, and track ATO/ATC packages and reauthorization efforts across HAPS capabilities, services, and hosted applications; ensure no lapse in ATO status
• Conduct and coordinate recurring vulnerability scans across infrastructure, containers, applications, and code repositories; track findings through POA&M closure within Government-defined timelines
• Draft and maintain Incident Response Plans and Disaster Recovery Plans, including RACI charts, and host/support annual IRP/DRP tabletop exercises
• Support all security audits and assessments (e.g., IG, SAVD, CCTF, OIS, ISRM, GRC, and independent assessors such as MITRE or Palo Alto), including documentation, findings review, and closeout meetings
• Maintain required security documentation (SIA, PIA, PTA, ISCP, SAP, SAR, Configuration Management Plan) and diagrams (ICD, HLD, security assessment boundary diagrams)
• Conduct periodic user access/account audits, enforce least-privilege and role-based access controls, and rotate service account credentials per VA policy and NIST guidelines
• Prepare and submit the Monthly RMF, Security, and ATO Status Report, clearly flagging deficiencies, emerging risks, and significant changes on the first page
• Support Technical Reference Model (TRM) software authorization submissions and Business Partner Extranet (BPE) connection request management as needed.
• This position requires some light travel.

• Bachelors degree in Cybersecurity, Computer Science, Information Technology, or a related field.
• Minimum of 12 years of experience in information security, cybersecurity engineering, or RMF compliance within Federal or DoD environments; candidates without a degree must have at least 18 years of relevant experience.
• Experience managing
• ATO/ATC activities
• Security assessments
• Continuous monitoring
• SNOWCAM
• Nessus scanning
• Vulnerability remediation
• Audit coordination
• Incident response planning
• Enterprise security governance
• Experience preparing and maintaining Authority to Operate (ATO)/Authority to Connect (ATC) packages and supporting artifacts (e.g., SSP, SAP, SAR, POA&M, ISCP)
• Experience conducting or coordinating vulnerability scanning, patch/remediation tracking, and continuous monitoring reporting for cloud-hosted platforms
• Experience developing and maintaining Incident Response Plans (IRP) and Disaster Recovery Plans (DRP), including facilitating tabletop exercises
• Working knowledge of applicable federal security and privacy requirements (FISMA, NIST 800-53, HIPAA, Privacy Act, FIPS)
• The ability to obtain and maintain a Public Trust security clearance.
• The ability to travel, as needed, to customer sites.
• Must have a US Citizenship.

The ideal candidate will bring:

• Experience supporting VA-specific RMF/ATO systems and processes (e.g., SNOWCAM, ICAMP, Technical Reference Model (TRM), CONMON)
• Experience coordinating directly with Authorizing Officials (AO), Information System Security Officers (ISSO), and Information System Owners (ISO) on authorization and security posture activities
• Experience conducting user access/account audits and enforcing role-based access control, Zero Trust Architecture, and least-privilege principles
• Experience supporting penetration testing, red team activities, or independent third-party security assessments
• Experience drafting Plan of Action and Milestones (POA&M) mitigation plans aligned to NIST control families and Control Correlation Identifiers (CCI)
• Experience managing external connection request processes (e.g., Business Partner Extranet) and software authorization submissions
• Eligibility for or possession of a security clearance or public trust position, as required.

If you’re looking for comfort, keep scrolling. At Leidos, we outthink, outbuild, and outpace the status quo - because the mission demands it. We’re not hiring followers. We’re recruiting the ones who disrupt, provoke, and refuse to fail. Step 10 is ancient history. We’re already at step 30 - and moving faster than anyone else dares. July 30, 2026

For U.S. Positions: While subject to change based on business needs, Leidos reasonably anticipates that this job requisition will remain open for at least 3 days with an anticipated close date of no earlier than 3 days after the original posting date as listed above.

Pay Range $131,300.00 - $237,350.00

The Leidos pay range for this job level is a general guideline only and not a guarantee of compensation or salary. Additional factors considered in extending an offer include (but are not limited to) responsibilities of the job, education, experience, knowledge, skills, and abilities, as well as internal equity, alignment with market data, applicable bargaining agreement (if any), or other law.

Leidos is an industry and technology leader serving government and commercial customers with smarter, more efficient digital and mission innovations. Headquartered in Reston, Virginia, with 47,000 global employees, Leidos reported annual revenues of approximately $16.7 billion for the fiscal year ended January 3, 2025. For more information, visit www.Leidos.com .

Pay and benefits are fundamental to any career decision. That’s why we craft compensation packages that reflect the importance of the work we do for our customers. Employment benefits include competitive compensation, Health and Wellness programs, Income Protection, Paid Leave and Retirement. More details are available at www.leidos.com/careers/pay-benefits .