Information Systems Security Engineer

The Information Systems Security Engineer will lead cybersecurity efforts for complex software projects within a United States Department of Defense (DoD) environment, with a strong focus on Risk Management Framework (RMF) compliance and secure cloud-based workloads. This role drives the creation, submission, and maintenance of security packages and authorizations, including obtaining and sustaining Authorization to Operate (ATO) for Amazon Web Services (AWS) container-based solutions. The position requires deep expertise in DoD cybersecurity processes, tools, and standards, as well as strong communication and collaboration skills across engineering, cybersecurity, business, and customer stakeholders., * Serve as an Information Systems Security Engineer (ISSE) for DoD software projects, providing cybersecurity leadership and guidance across the full system lifecycle.

• Generate and submit complete System Security Packages (SSPs), Plans of Action and Milestones (POA&Ms), and other required artifacts to support DoD Risk Management Framework (RMF) and Security Technical Implementation Guide (STIG) processes.
• Apply DoD cybersecurity tools, including eMASS and STIG Viewer, to build, manage, and validate security packages and supporting documentation.
• Obtain and maintain at least one DoD Authorization to Operate (ATO) for AWS-deployed container-based workloads, ensuring ongoing compliance with DoD security requirements.
• Inform and define software mitigation requirements based on results from static application security testing (SAST) tools such as SonarQube and container scanning tools such as Trivy.
• Recommend and validate data protection mechanisms, including encryption and access control strategies, to safeguard sensitive information in deployed workloads.
• Test and verify security controls to ensure they function as designed and effectively reduce risk across applications and infrastructure.
• Conduct threat modeling activities to identify potential attack vectors and prioritize security mitigations for software systems and cloud workloads.
• Lead vulnerability management activities, including identifying, tracking, and coordinating remediation of security findings across development and operations teams.
• Monitor the security posture of deployed workloads, leveraging appropriate tools and processes to detect and respond to anomalous or malicious activity.
• Collaborate effectively with engineering, cybersecurity, business, and customer stakeholders throughout the RMF cybersecurity lifecycle, ensuring clear communication of risks, requirements, and progress.
• Provide security guidance and input to DevSecOps teams across multiple software releases, helping integrate security best practices into continuous integration and deployment processes.
• Use system security tools such as Wiz or eMASSter to support security posture assessment, reporting, and ongoing compliance activities.
• Contribute to the design and operation of Security Operations Center (SOC) functions, using tools such as Splunk or CloudWatch to support monitoring and incident response.
• Leverage AWS security services, including Security Hub and GuardDuty, to strengthen detection, response, and compliance capabilities in cloud environments.
• Apply knowledge of CIS benchmarks and other industry security standards to align system configurations and controls with recognized best practices.
• Support or coordinate activities related to penetration testing, fuzz testing, and dynamic application security testing (DAST), and use results to drive remediation and improvement.
• Document security requirements, decisions, and outcomes clearly and comprehensively to support audits, assessments, and continuous improvement., Use of Artificial Intelligence (AI): We may use Artificial Intelligence (AI) to support parts of our hiring process, including sourcing, screening, and evaluating candidates. AI helps assess applications and qualifications, but final decisions are made by our hiring team. By applying, you acknowledge and agree that your application may be reviewed using AI tools. Related Jobs Cybersecurity Engineer SME Leidos

Bethesda, MD*On-Site

Linux CI/CD Splunk Nessus Rapid7 Ansible Auditing Firewall Equities Scripting SonarQube DevSecOps Pipelines Operations Automation Purchasing Upskilling Market Data Coordinating Oracle Cloud Cryptography Investigation Cyber Security Key Management Risk Management Authentications Cloud Computing Ancient History Network Security Security Controls Incident Response CompTIA Security+ Digital Forensics System Monitoring Endpoint Security Cyber Engineering Analytical Method Windows PowerShell AWS CloudFormation Systems Engineering Amazon Web Services Time Off Management Security Engineering Software Development Contingency Planning Signals Intelligence Programming Languages Regulatory Frameworks Vulnerability Scanning Security Configuration, Planning Firewall Firmware Equities Mitigation CNSSI 1253 Market Data Gap Analysis Risk Analysis Risk Management Network Routing Ancient History Computer Science Security Systems Operating Systems Security Policies Network Protocols Information Privacy Networking Hardware Network Engineering Network Architecture Information Assurance Communications Systems Information Systems Security Security Requirements Analysis Certified Information Systems Security Professional Top Secret-Sensitive Compartmented Information (TS/SCI Clearance) +0

Google IT Support Information Systems Security Engineer Actalent

Columbia, MD*Remote

Auditing Hardening Visionary SonarQube DevSecOps Operations Leadership Innovation Mitigation Encryption Coordinating Fuzz Testing Communication Collaboration Cyber Security Prioritization Cloud Security Security Tools Attack Vectors Access Controls Threat Modeling Software Systems Security Controls Amazon CloudWatch Industry Standards Penetration Testing Amazon Web Services Information Privacy Continuous Delivery Continuous Integration Effective Communication Vulnerability Management Risk Management Framework Authorization (Computing) Engineering Design Process Information Systems Security Security Requirements Analysis Continuous Improvement Process Plan Of Action And Milestones (POA&M) Static Application Security Testing (SAST) Dynamic Application Security Testing (DAST) CompTIA Advanced Security Practitioner (CASP+) Certified Information Systems Security Professional Enterprise Mission Assurance Support Service (eMASS), * At least 5 years of experience serving as an Information Systems Security Engineer (ISSE) for United States Department of Defense (DoD) software projects.

• Proven experience generating and submitting System Security Packages (SSPs), Plans of Action and Milestones (POA&Ms), and other artifacts required for DoD Risk Management Framework (RMF) and Security Technical Implementation Guide (STIG) processes.
• Hands-on experience applying DoD cybersecurity tools such as eMASS and STIG Viewer to develop and manage security packages.
• Demonstrated success obtaining and maintaining at least one DoD Authorization to Operate (ATO) for an AWS-deployed container-based workload.
• Strong background in cyber security, including threat modeling, vulnerability management, security monitoring, and data protection for deployed workloads.
• Experience informing software mitigation requirements based on output from static application security testing (SAST) tools such as SonarQube.
• Experience using container scanning tools such as Trivy to identify and remediate vulnerabilities in containerized workloads.
• Demonstrated expertise in recommending and validating data protections and testing security controls for complex systems.
• Track record of effective communication and collaboration throughout the RMF cybersecurity lifecycle with engineering, cybersecurity, business, and customer stakeholders.
• Possession of one or more relevant cybersecurity certifications, such as CISSP, CASP, or Security+., * Experience with United States Intelligence Community (IC) system cybersecurity processes and tools.
• background in establishing or operating Security Operations Center (SOC) functions, including use of tools such as Splunk or CloudWatch.
• Hands-on experience with AWS security services, such as Security Hub and GuardDuty, to enhance cloud security monitoring and compliance.
• Experience serving as an ISSE on a DevSecOps team through multiple software releases, integrating security into continuous delivery pipelines.
• Familiarity with system security tools such as Wiz or eMASSter for posture assessment and compliance tracking.
• Knowledge of CIS benchmarks and other industry security standards, and the ability to apply them to system hardening and configuration.
• Exposure to penetration testing, fuzz testing, and dynamic application security testing (DAST) tools and techniques, with the ability to interpret results and support remediation., Individual compensation offered for this position within this range will depend on many factors, including qualifications, skills, relevant experience, job knowledge, geographic location, internal equity, and other pertinent job-related factors., Cyber Security Policies Configuration Management Vulnerability Management Certified Ethical Hacker Cyber Security Standards Cybersecurity Compliance Risk Management Framework Authorization (Computing) Cyber Threat Intelligence Cyber Security Assessment IT Security Documentation Agile Software Development Splunk Enterprise Security Google Cloud Platform (GCP) Computer Network Operations Change Management Processes Information Systems Security Customer Information Systems React.js (Javascript Library) Python (Programming Language) Enterprise Application Software Endpoint Detection And Response Troubleshooting (Problem Solving) Host Based Security System (HBSS) Intrusion Detection And Prevention CompTIA Cybersecurity Analyst (CySA+) Plan Of Action And Milestones (POA&M) Security Information And Event Management (SIEM) Certified Information Systems Security Professional, Hardening Visionary SonarQube DevSecOps Operations Leadership Innovation Mitigation Encryption Coordinating Fuzz Testing Communication Collaboration Cyber Security Prioritization Cloud Security Security Tools Attack Vectors Access Controls Threat Modeling Software Systems Security Controls Amazon CloudWatch Industry Standards Penetration Testing Amazon Web Services Information Privacy Continuous Delivery Continuous Integration Effective Communication Vulnerability Management Risk Management Framework Authorization (Computing) Engineering Design Process Information Systems Security Security Requirements Analysis Continuous Improvement Process Plan Of Action And Milestones (POA&M) Static Application Security Testing (SAST) Dynamic Application Security Testing (DAST) CompTIA Advanced Security Practitioner (CASP+) Certified Information Systems Security Professional Enterprise Mission Assurance Support Service (eMASS)

Actalent is a global leader in engineering and sciences services and talent solutions. We help visionary companies advance their engineering and science initiatives through access to specialized experts who drive scale, innovation and speed to market. With a network of almost 20,000 consultants and 5,000 clients across the U.S., Canada, Asia and Europe, Actalent serves many of the Fortune 500. We are proud to be an Engineering News-Record (ENR) Top 500 Design Firm for our engineering design services and a ClearlyRated Best of Staffing® winner for both client and talent service.