Cyber Security InfoSec Engineer - SC-51

AttainIT Technologies is seeking a Cyber Security InfoSec Engineer to support a technical development program focused on cloud-based applications and cloud infrastructure operating on a highly secure network. In this information systems security engineering role, you will help integrate security practices into the SDLC for a 100% AWS environment, while supporting Assessment and Authorization (A&A) needs.

This onsite position is based in Virginia and calls for 6+ years of experience, along with an active clearance profile to meet program requirements. You will work with an Agile team to evaluate architecture changes, conduct security scanning and analysis, and maintain RMF/A&A documentation and continuous monitoring activities.

Key responsibilities

• Participate in the team’s regularly scheduled Agile tag up (scrum) meetings and provide status updates on assigned Jira issues
• Attend ad-hoc technical exchange meetings (TEMs) to assess architectural aspects and evaluate security impacts from system changes
• Assist with and/or lead security scans, then report and analyze findings for potential security impacts
• Review externally identified security findings (including CVEs) for system impact analysis and recommended next steps for remediation
• Participate in team TEMs and review upcoming system changes and new features for security implications
• Identify, select, implement, and assess NIST SP 800-53 security and privacy controls
• Develop, establish, and integrate secure configuration baselines aligned to DISA STIGs and CIS benchmark guidelines
• Support secure architecture and design development activities
• Ensure security requirements are integrated into the System/Software Development Life Cycle (SDLC)
• Perform Continuous Monitoring (ConMon) activities supporting Assessment and Authorization (A&A)
• Review, create, and maintain relevant A&A artifacts
• Conduct security analysis and monitoring for a 100% AWS cloud-based system
• Perform vulnerability scanning and analysis of the system
• Support remediation by developing security implementations based on security findings
• Interface with Information System Security Managers (ISSM) to help develop and accredit the system
• Participate in or lead technical exchange meetings, document outcomes, and brief management as needed

Required qualifications

• Active TS/SCI with Polygraph
• Bachelor of Science (BS) degree, or relevant demonstrable experience
• Hands-on experience with Linux (CLI)
• Hands-on scripting and programming experience with BASH and Python
• Strong understanding of networking concepts such as ports, routing tables, subnets, VPNs, firewalls, routers, including design, integration, and troubleshooting
• Experience working on teams using Agile workflows and processes
• Strong understanding of NIST SP 800-37, NIST SP 800-53, NIST SP 800-160, DISA/CIS STIGs, and Common Vulnerabilities and Exposures (CVEs)
• Experience with RMF workflow tools
• Strong communication, organizational, and writing skills
• Ability to clearly articulate findings and recommendations
• Openness to considering alternative approaches to security issues raised by other team members

Technologies and frameworks

• Linux (CLI), BASH, Python
• AWS
• Jira
• NIST SP 800-53, DISA STIGs, CIS benchmark guidelines
• NIST SP 800-37, NIST SP 800-160
• Common Vulnerabilities and Exposures (CVEs)
• RMF workflow tools
• SDLC, Assessment and Authorization (A&A), Continuous Monitoring (ConMon)

Benefits

• Competitive salary
• Health, dental, and vision insurance
• PTO and federal holidays
• Matching 401(k)
• Education and training reimbursement
• Performance bonuses and referral bonuses
• Corporate events

Desired skills

• Relevant IT certifications (examples include CISSP, AWS Cloud Practitioner, AWS Cloud Security, AI security)
• Experience with Infrastructure as Code (IaC) such as Ansible or Terraform, or other configuration and automation tools
• Experience working in a cloud-based environment (AWS)

COVID-19 vaccination policy: Employees are required to adhere to the customer’s vaccination policy.