Cybersecurity Engineer

Caribou Thunder is seeking a Cybersecurity Engineer to support cybersecurity engineering and Risk Management Framework (RMF) activities for mission-critical defense systems. This onsite role in Colorado Springs, CO focuses on security compliance, vulnerability identification, control validation, and Assessment and Authorization (A&A) support, working closely with engineering teams, program personnel, and Government stakeholders.

The position contributes to maintaining secure system configurations and keeping RMF documentation and evidence current for authorization and continued operation, including coordination with program offices and systems records management.

What you’ll do

• Assess systems and networks to identify deviations from approved configurations, enclave policies, security baselines, and local security requirements.
• Perform security compliance evaluations using tools such as STIG Viewer, SCAP, Evaluate-STIG, STIG Manager, and other applicable compliance assessment technologies.
• Author, update, and review security testing documentation, including security assessment plans, test cases, and cybersecurity test methodologies.
• Conduct annual security control assessments and support continuous monitoring to verify control effectiveness over time.
• Provide technical input for Security Assessment Reports (SARs), Risk Assessment Reports (RARs), and other cybersecurity assessment deliverables.
• Coordinate with the program’s System Program Office (SPO) contractor and Government personnel to maintain accurate system records in eMASS.
• Collect, prepare, organize, and maintain RMF body of evidence, including documentation of operational processes, procedures, and site-specific security requirements.
• Prepare and update RMF artifacts supporting A&A, including Plans of Action and Milestones (POA&Ms).
• Review RMF documentation and security artifacts to identify gaps, inconsistencies, and deviations from applicable security control requirements.
• Support implementation of Government cybersecurity policies and standards, including NISPOM, NIST, DoD, and Air Force instructions as applicable.
• Establish and maintain program control processes that support risk mitigation, security compliance, and system authorization.
• Assist with control certification testing, compliance documentation, technical investigations, software research, hardware introduction and release activities, emerging technology research, inspections, and periodic audits.
• Analyze cybersecurity controls and requirements to validate effectiveness and recommend safeguards.
• Coordinate with program stakeholders to investigate and resolve deficiencies found during RMF assessments.
• Support vulnerability management, system hardening, and remediation activities to strengthen the security posture of systems and networks.
• Collaborate with cybersecurity engineers, system administrators, software teams, and Government representatives to maintain compliance with security requirements.
• Maintain clear technical documentation and communicate assessment results, risks, and recommended corrective actions to relevant stakeholders.
• Level 3 engineers will take on greater responsibility for complex assessments, RMF artifact reviews, deficiency resolution, and coordination of cybersecurity activities across the program.

Requirements

• Bachelor’s degree and 5 years of relevant work experience; OR Master’s degree and 3 years; OR PhD and 1 year.
• Active U.S. Government Secret security clearance, current and within scope, at the time of application.
• Current DoD 8570.01M IAT Level II certification, such as Security+ CE, CCNA Security, GSEC, or SSCP.
• Experience in cybersecurity or security engineering, including cybersecurity principles, risk management, security assessments, vulnerability management, and/or system hardening.
• Experience with cybersecurity frameworks, standards, tools, or technologies used to assess and secure information systems.
• Ability to evaluate security requirements, identify compliance deficiencies, and support corrective actions.
• Ability to prepare and maintain technical documentation and communicate cybersecurity findings to engineering teams and stakeholders.

Technologies

• STIG Viewer, SCAP, Evaluate-STIG, STIG Manager, STIGs, SCAP Compliance Checker (SCC), ACAS, Nessus, Tenable.sc
• SIEM, Ansible, Python, Jira, Atlassian tools, VMware, Elastic Stack, eMASS
• DoDI 8500.01, NIST SP 800-53, NIST SP 800-115, NISPOM, NIST, DoD, Air Force instructions, DoD 8570.01M
• Security+ CE, CCNA Security, GSEC, SSCP, OSCP, OSCE, GPEN, GWAPT, GXPN, CISSP, Xylok
• Red Hat Enterprise Linux (RHEL), Ansible or Python

Benefits

• Premium Health, Dental & Vision Insurance
• 401(k) with 6% Company Match
• Flexible PTO & Work Schedule
• Education & Certification Reimbursement
• Support for Military Leave
• Work–Life Balance & Traditional Family Values

Preferred qualifications

• Working knowledge of cybersecurity technologies and DoD/Federal cybersecurity policy, including DoDI 8500.01, NIST SP 800-53, and NIST SP 800-115.
• Familiarity with the RMF cybersecurity lifecycle, including development of testable security controls and assessment procedures.
• Experience conducting vulnerability and compliance scans using ACAS, Nessus, or Tenable.sc.
• Linux system administration experience.
• Experience implementing STIGs and hardening system configurations.
• Bachelor’s degree in a STEM discipline with 8 years of cybersecurity engineering and/or testing experience; or 7 years with a master’s degree; or 4 years with a PhD (relevant experience may be considered in lieu of a degree).
• Penetration testing certifications such as OSCP, OSCE, GPEN, GWAPT, or GXPN.
• Experience using or configuring SIEM and log aggregation software.
• Experience conducting cybersecurity assessments of RHEL environments.
• Understanding of networking concepts, including subnetting, firewalls, NAT, ACLs, and VLANs.
• Familiarity with STIG/SCAP compliance scanning using tools such as SCC, Evaluate-STIG, STIG Manager, and Xylok.
• Experience automating security scanning and compliance activities using Ansible or Python.
• Familiarity with Agile development methodologies, including Scrum, Kanban, or SAFe.
• Experience with Jira and other Atlassian tools.
• VMware and containerization experience.
• Experience with eMASS and ATO processes.
• Experience with the Elastic Stack.
• Cross-Domain Solution (CDS) experience, including authorization activities and coordination with the Cross-Domain Support Element (CDSE) and National Cross Domain Strategy & Management Office (NCDSMO).
• DoD IAT Level III certification, such as CISSP.
• Ability and willingness to travel CONUS and OCONUS up to 25%.

Travel

• Ability and willingness to travel CONUS and OCONUS up to 25%.

Location: Colorado Springs, CO (onsite)

Compensation: USD 100,000 to 117,000 per year

Minimum experience: 1 year