Information System Security Engineer

The Information System Security Engineer (ISSE) serves as a dedicated, customer-facing cybersecurity engineering consultant supporting organizational ISSMs, ISSOs, Mission Partners, system owners, architects, and development teams. The ISSE provides expert security architecture and Risk Management Framework (RMF) guidance for on-premises, cloud-hosted, legacy, and modernizing systems throughout the System Development Lifecycle (SDLC)., * Serve as the embedded security engineering expert for Mission Partners, ISSMs, ISSOs, system owners, architects, and development teams.

• Provide security engineering support throughout the SDLC, including requirements gathering, design reviews, sprint planning, modernization, implementation, and production.
• Translate RMF, NIST SP 800-53, DoD cybersecurity policy, and other governance requirements into actionable, threat-informed engineering solutions.
• Conduct in-depth security architecture and design reviews for new and existing systems.
• Analyze network architectures, cloud-native architectures, applications, APIs, microservices, containers, serverless functions, interfaces, and data flows to identify security weaknesses.
• Collaborate with architects and developers to identify achievable security controls and reduce compliance friction before formal assessment.
• Engineer and document vulnerability mitigation strategies and provide technical consultation supporting POA&M corrective actions.
• Develop solutions that reduce system attack surface and improve resiliency without unnecessarily compromising mission capability.
• Translate security requirements into specific technical implementation activities such as MFA, database encryption, secure network zoning, and related controls.
• Apply DoD STIGs, SRGs, and PPSM guidance to system engineering activities.
• Use security telemetry and findings from SIEM, vulnerability scanning, and EDR technologies to recommend architectural and engineering improvements.
• Provide technical mentorship and guidance to ISSMs, ISSOs, developers, and system owners.
• Present cybersecurity risks, architectural findings, mitigation strategies, and recommendations to technical personnel and Government leadership.
• Document customer interactions, systems supported, issues addressed, and technical recommendations as required.

• 10+ years of related experience.
• Security Architect Certification requirement (must have at least one of the following): Security X/CASP+CE, CCSP, Cloud+, CISSP, CSSLP, CISM, CISSP-ISSAP, CISSP-ISSIP, CSSLP, and GSEC.
• Must have and maintain a current DoD Top Secret clearance.
• Expert-level knowledge of RMF, NIST SP 800-37, NIST SP 800-53 security, and privacy controls. xrbllit
• Practical experience applying DoD STIGs, SRGs, and PPSM requirements.