Cybersecurity Engineer

Support cybersecurity engineering and Risk Management Framework (RMF) activities for mission-critical defense systems in Colorado Springs, CO.

Responsibilities

• Assess systems and networks for deviations from approved configurations, enclave policies, security baselines, and local security requirements.
• Conduct security compliance evaluations using tools such as STIG Viewer, SCAP, Evaluate-STIG, STIG Manager, and other applicable technologies.
• Author, update, and review security testing documentation, including security assessment plans, test cases, and cybersecurity test methodologies.
• Perform annual security control assessments and support continuous monitoring to verify control effectiveness.
• Provide technical input for Security Assessment Reports (SARs), Risk Assessment Reports (RARs), and other cybersecurity assessment deliverables.
• Coordinate with the program’s System Program Office (SPO) contractor and Government personnel to keep system records current in eMASS.
• Collect, prepare, organize, and maintain RMF evidence, including operational process documentation, procedures, and site-specific security requirements.
• Prepare and update RMF artifacts that support Assessment and Authorization (A&A), including POA&Ms.
• Review RMF documentation and security artifacts to identify gaps, inconsistencies, and deviations from applicable security control requirements.
• Support implementation of Government cybersecurity policies and standards, including NISPOM, NIST, DoD, and Air Force instructions as applicable.
• Help establish and maintain program control processes that support risk mitigation, security compliance, and system authorization.
• Support control certification testing, compliance documentation, technical investigations, software research, hardware introduction and release activities, emerging technology research, inspections, and periodic audits.
• Analyze cybersecurity controls and requirements to validate effectiveness and recommend safeguards.
• Coordinate with program stakeholders to investigate and resolve deficiencies identified during RMF assessments.
• Support vulnerability management, system hardening, and remediation to improve security posture.
• Collaborate with cybersecurity engineers, system administrators, software teams, and Government representatives to maintain security compliance.
• Maintain clear technical documentation and communicate assessment results, risks, and corrective actions to stakeholders.
• Level 3 engineers: take on greater responsibility for complex assessments, RMF artifact reviews, deficiency resolution, and coordination of cybersecurity activities across the program.

Requirements

• Bachelor’s + 5 years relevant work experience; OR Master’s + 3 years; OR PhD + 1 year.
• Active U.S. Government Secret security clearance, current and within scope, at time of application.
• Current DoD 8570.01M IAT Level II certification (examples: Security+ CE, CCNA Security, GSEC, SSCP).
• Experience in cybersecurity or security engineering, including principles, risk management, security assessments, vulnerability management, and/or system hardening.
• Experience with cybersecurity frameworks, standards, tools, or technologies used to assess and secure information systems.
• Ability to evaluate security requirements, identify compliance deficiencies, and support corrective action development.
• Ability to prepare and maintain technical documentation and communicate findings to engineering teams and stakeholders.

Technologies

• STIG Viewer, SCAP, Evaluate-STIG, STIG Manager, STIGs, SCAP Compliance Checker (SCC), ACAS, Nessus, Tenable.sc
• SIEM, Ansible, Python, Jira, Atlassian tools, VMware, Elastic Stack
• eMASS, DoDI 8500.01, NIST SP 800-53, NIST SP 800-115, NISPOM, NIST, DoD, Air Force instructions
• DoD 8570.01M, Security+ CE, CCNA Security, GSEC, SSCP, OSCP, OSCE, GPEN, OSCP, OSCE, GPEN, GWAPT, GXPN, CISSP, Xylok
• Red Hat Enterprise Linux (RHEL), Ansible or Python

Benefits

• Premium Health, Dental & Vision Insurance
• 401(k) with 6% Company Match
• Flexible PTO & Work Schedule
• Education & Certification Reimbursement
• Support for Military Leave
• Work–Life Balance & Traditional Family Values

Preferred Qualifications

• Working knowledge of cybersecurity technologies and DoD/Federal policy, including DoDI 8500.01, NIST SP 800-53, and NIST SP 800-115.
• Familiarity with RMF lifecycle, including development of testable security controls and assessment procedures.
• Experience conducting vulnerability and compliance scans using ACAS, Nessus, or Tenable.sc.
• Linux system administration experience.
• Experience implementing STIGs and hardening system configurations.
• STEM degree and experience options: Bachelor’s with 8 years; Master’s with 7 years; PhD with 4 years; relevant experience may be considered in lieu of degree.
• Penetration testing certifications: OSCP, OSCE, GPEN, GWAPT, or GXPN.
• Experience using/configuring SIEM and log aggregation software.
• Experience conducting cybersecurity assessments of RHEL environments.
• Networking concepts: subnetting, firewalls, NAT, ACLs, VLANs.
• Familiarity with STIG/SCAP compliance scanning using SCC, Evaluate-STIG, STIG Manager, and Xylok.
• Experience automating security scanning and compliance activities using Ansible or Python.
• Familiarity with Agile methodologies (Scrum, Kanban, or SAFe).
• Experience with Jira and other Atlassian tools.
• VMware and containerization experience.
• Experience with eMASS and ATO processes.
• Experience with Elastic Stack.
• Cross-Domain Solution (CDS) experience, including authorization activities and coordination with CDSE and NCDSMO.
• DoD IAT Level III certification such as CISSP.
• Ability and willingness to travel CONUS and OCONUS up to 25%.

Travel Requirements

• Ability and willingness to travel CONUS and OCONUS up to 25%.

Location: Colorado Springs, CO (onsite)

Salary: USD 100,000 - 117,000 per yearly