> Markdown version of [/jobs/ext/1505719-senior-information-security-engineer](https://www.wearedevelopers.com/jobs/ext/1505719-senior-information-security-engineer). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Senior Information Security Engineer - **Company:** Leidos, Inc. - **Location:** United States (Remote available) - **Experience:** Expert - **Salary:** $131,300.0 - $237,350.0 - **Contract:** Permanent contract - **Skills:** Software System Penetration Testing, Configuration Management, Cyber Security, Information Systems, Extranet, Federal Information Processing Standards (FIPS), Information Security Management, Role-Based Access Control, Red Team (Cyber Security), Zero Trust Network Access, SAP (Applications), Software Vulnerability Management, Information Technology, Nessus, Plan of Action and Milestones, Vulnerability Analysis - **Published:** July 30, 2026 - **Apply:** https://www.clearancejobs.com/jobs/9067442/senior-information-security-engineer ## About the Role * Bachelors degree in Cybersecurity, Computer Science, Information Technology, or a related field. * Minimum of 12 years of experience in information security, cybersecurity engineering, or RMF compliance within Federal or DoD environments; candidates without a degree must have at least 18 years of relevant experience. * Experience managing + ATO/ATC activities + Security assessments + Continuous monitoring + SNOWCAM + Nessus scanning + Vulnerability remediation + Audit coordination + Incident response planning + Enterprise security governance * Experience preparing and maintaining Authority to Operate (ATO)/Authority to Connect (ATC) packages and supporting artifacts (e.g., SSP, SAP, SAR, POA&M, ISCP) * Experience conducting or coordinating vulnerability scanning, patch/remediation tracking, and continuous monitoring reporting for cloud-hosted platforms * Experience developing and maintaining Incident Response Plans (IRP) and Disaster Recovery Plans (DRP), including facilitating tabletop exercises * Working knowledge of applicable federal security and privacy requirements (FISMA, NIST 800-53, HIPAA, Privacy Act, FIPS) * The ability to obtain and maintain a Public Trust security clearance. * The ability to travel, as needed, to customer sites. * Must have a US Citizenship. The ideal candidate will bring: * Experience supporting VA-specific RMF/ATO systems and processes (e.g., SNOWCAM, ICAMP, Technical Reference Model (TRM), CONMON) * Experience coordinating directly with Authorizing Officials (AO), Information System Security Officers (ISSO), and Information System Owners (ISO) on authorization and security posture activities * Experience conducting user access/account audits and enforcing role-based access control, Zero Trust Architecture, and least-privilege principles * Experience supporting penetration testing, red team activities, or independent third-party security assessments * Experience drafting Plan of Action and Milestones (POA&M) mitigation plans aligned to NIST control families and Control Correlation Identifiers (CCI) * Experience managing external connection request processes (e.g., Business Partner Extranet) and software authorization submissions * Eligibility for or possession of a security clearance or public trust position, as required. ## Description The Digital Sector at Leidos currently has an opening for a Senior Information Security Engineer to support the Department of Veterans Affairs' Office of Information & Technology (OIT). In this contract, Leidos assists with the underlying infrastructure, tools, and operational services used to build, deploy, secure, and run VA health applications. The Senior Information Security Engineer plays a critical role in advancing cybersecurity operations for mission-critical Federal cloud environments by leading RMF activities, ATO/ATC efforts, security assessments, continuous monitoring, vulnerability management, and risk remediation. This position develops and maintains key security documentation, supports audits and authorization activities, and drives the implementation of security governance, incident response, and access control practices in alignment with Federal cybersecurity requirements and NIST standards. The selected candidate will: * Support all six steps of the NIST RMF lifecycle and develop/maintain required RMF documentation and security diagrams * Prepare, submit, and track ATO/ATC packages and reauthorization efforts across HAPS capabilities, services, and hosted applications; ensure no lapse in ATO status * Conduct and coordinate recurring vulnerability scans across infrastructure, containers, applications, and code repositories; track findings through POA&M closure within Government-defined timelines * Draft and maintain Incident Response Plans and Disaster Recovery Plans, including RACI charts, and host/support annual IRP/DRP tabletop exercises * Support all security audits and assessments (e.g., IG, SAVD, CCTF, OIS, ISRM, GRC, and independent assessors such as MITRE or Palo Alto), including documentation, findings review, and closeout meetings * Maintain required security documentation (SIA, PIA, PTA, ISCP, SAP, SAR, Configuration Management Plan) and diagrams (ICD, HLD, security assessment boundary diagrams) * Conduct periodic user access/account audits, enforce least-privilege and role-based access controls, and rotate service account credentials per VA policy and NIST guidelines * Prepare and submit the Monthly RMF, Security, and ATO Status Report, clearly flagging deficiencies, emerging risks, and significant changes on the first page * Support Technical Reference Model (TRM) software authorization submissions and Business Partner Extranet (BPE) connection request management as needed. * This position requires some light travel. ## Related Videos - [Security Pitfalls for Software Engineers](https://www.wearedevelopers.com/videos/726-security-pitfalls-for-software-engineers) - [Thinking Differently - How to Make Money from Cyber Attacks & Cheats](https://www.wearedevelopers.com/videos/745-thinking-differently-how-to-make-money-from-cyber-attacks-cheats) - [Cyber Security: Small, and Large!](https://www.wearedevelopers.com/videos/259-cyber-security-small-and-large) - [You can’t hack what you can’t see](https://www.wearedevelopers.com/videos/41-you-can-t-hack-what-you-can-t-see) - [Organizational Change Through The Power Of Why - DevSecOps Enablement](https://www.wearedevelopers.com/videos/478-organizational-change-through-the-power-of-why-devsecops-enablement) - [Less Is More: How Lagom and Agile Can Create Harmonious Workflows](https://www.wearedevelopers.com/videos/1993-less-is-more-how-lagom-and-agile-can-create-harmonious-workflows) ## Related Articles - [9 Ways to Make Money Hacking](https://www.wearedevelopers.com/magazine/333-9-ways-to-make-money-hacking) - [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed) - [Understanding and Mitigating Common Web Vulnerabilities](https://www.wearedevelopers.com/magazine/565-understanding-and-mitigating-common-web-vulnerabilities) - [Fully Remote Software Engineer Jobs](https://www.wearedevelopers.com/magazine/447-fully-remote-software-engineer-jobs) - [Dev Digest 134 - Where pixels sing?](https://www.wearedevelopers.com/magazine/477-dev-digest-134-where-pixels-sing) - [The Overflow: Security and Privacy](https://www.wearedevelopers.com/magazine/715-the-overflow-security-and-privacy)