Security Engineer II

Paragon Technology is seeking a Security Engineer II to support USTRANSCOM under the PEO-T contract at Scott AFB, IL (onsite).

Responsibilities

• Review evolving NIST requirements to support risk assessment activities tied to affiliated system requirements and specifications, including execution, mapping, and compliance tracking.
• Produce detailed specifications to remediate cybersecurity gaps identified during risk assessments and perform follow-up risk assessments to ensure secure coding practices and STIG/SRG implementation are built-in and enforced to the greatest extent possible.
• Collaborate with government customers to develop POA&Ms and support risk acceptance activities as part of risk management processes.
• Design and implement security solutions to protect confidentiality, integrity, and availability of sensitive information.
• Provide technical evaluations of IT systems and support security improvement efforts.
• Participate in designing information system contingency plans that maintain appropriate protection levels and meet time requirements to minimize operational impact.
• Conduct security product evaluations and recommend products, technologies, and upgrades to strengthen the organization’s security posture.
• Perform security testing and review audit logs to evaluate effectiveness of current security measures.
• Support team deliverables and peer reviews of others’ products.

Requirements

• Experience developing and/or reviewing system authorization documentation (family plans and supplementary artifacts) aligned to Department of War (DoW) implementation of the Risk Management Framework (RMF).
• Experience participating in Technical Interchange Meetings (TIMs) covering a range of PMO security engineering topics.
• Experience participating in acquisition program engineering milestone reviews.
• Experience coordinating with development contract personnel across Security, System Administration, System Engineering, and related roles to identify, document, and plan security enhancement requirements and resolve program security issues.
• Experience coordinating with inheritance providers (including enterprise teams in USTRANSCOM, SDDC, AMC, DISA Security Office, etc.) to define hybrid security requirements and establish inheritance relationships using provided tools.
• Experience performing security activities required to maintain authorization of PMO programs, such as categorization, control selection, evidence collection and audit, risk assessments, reporting, security impact assessments for change management, Incident Response/Contingency Plan exercise support, FISMA reporting, and Continuous Monitoring.
• Experience using DoW Enterprise Mission Assurance Support Service (eMASS).
• Experience supporting design, development, and deployment aligned to applicable Executive Orders, federal policy, DoW regulations, USTRANSCOM requirements, and commercial best practices.
• Experience reviewing vulnerability scans using ACAS/Nessus, analyzing outputs to identify vulnerabilities, recommending mitigation/remediation, and ingesting actions in eMASS.
• Experience supporting government customer critical review of DISA STIGs/SRGs, providing technical feedback and recommendations to improve reporting accuracy for qualitative results, and ingesting final products in government-supplied tools to support NIST control risk assessment.
• Experience generating and reporting status associated with POA&M requirements (including sustaining and extending when appropriate).
• Experience conducting and evaluating security testing activities including security assessments and audits.
• Experience supporting operational security activities such as risk mitigation, host security, encryption, intrusion detection, VPN implementations, and viral detection.
• Experience with security lockdown and/or hardening of servers and network devices.
• Ability to coordinate overall security strategy with multiple agencies and Authorizing Official (AO) representatives.
• Ability to coordinate with developers, vendors, and other government organizations/agencies to assess security engineering issues.
• Experience recommending changes to network and security architecture to improve security posture and meet operational performance requirements.
• US Citizen with an active DoW Secret (or higher) clearance.
• Bachelor’s degree in Computer Science, Cybersecurity, or equivalent IT academic studies.
• Active IAM II Certification in good standing (examples include ISC2 CGRC, CompTIA Security X, ISACA CISM, ISC2 CISSP (or associate), GIAC GSLC, EC-Council CCISO).
• 1+ years of security engineering experience as an ISSO, ISSM, SCA, or Cyber Security Analyst/Engineer.

Technologies

• NIST, ISCM, STIG, SRG
• RMF, A&A reporting, POA&M
• eMASS (DoW Enterprise Mission Assurance Support Service)
• ACAS, Nessus
• DISA STIGs/SRGs
• FISMA, VPN

Working Conditions

• Primarily performed in a professional office or government facility environment.
• May require participation in classified discussions consistent with clearance level.
• Collaboration with geographically dispersed stakeholders is expected.
• Standard business hours with occasional schedule flexibility to support mission needs.

Compensation

• USD 80,000 - 85,000 per year