Security Engineer II

What you’ll do

• Review evolving NIST requirements to support risk assessment activities tied to affiliated system requirements and specifications, including execution, mapping, and compliance tracking.
• Develop detailed specifications to mitigate or remediate cybersecurity deficiencies identified during risk assessment, and perform follow-up risk assessments to help ensure secure coding practices and STIG/SRG implementation are built in and enforced.
• Collaborate with government customers to develop and support POA&Ms, including support for risk acceptance activities to sustain risk management processes.
• Design and implement solutions to protect the confidentiality, integrity, and availability of sensitive information.
• Provide technical evaluations of IT systems and support security improvements.
• Participate in the design of information system contingency plans that maintain appropriate protection levels and meet time requirements to minimize operational impact to the customer organization.
• Conduct security product evaluations and recommend products, technologies, and upgrades to strengthen the organization’s security posture.
• Perform testing and review audit logs to evaluate the effectiveness of current security measures.
• Support team deliverables, including drafting deliverables and participating in peer reviews.

Security engineering, reporting, and program authorization support

• Support security authorization documentation activities, including family plans and supplementary artifacts, in accordance with the Department of War (DoW) implementation of the Risk Management Framework (RMF).
• Maintain authorization readiness for PMO programs through activities such as categorization, control selection, evidence collection and audit, risk assessments, reporting, security impact assessments associated with change management practices, and ISCM.
• Contribute to A&A reporting and related requirements such as FISMA reporting and Continuous Monitoring.
• Generate, sustain, extend (when appropriate), and report status tied to POA&M requirements.
• Use the DoW Enterprise Mission Assurance Support Service (eMASS) system to support authorization-related workflows.

Vulnerability assessment and STIG/SRG feedback

• Review vulnerability scan outputs using ACAS/Nessus, analyze results to identify vulnerabilities, recommend mitigation and remediation actions, and ingest actions in eMASS.
• Provide support to help the Government Customer conduct critical review of documented DISA STIGs/SRGs, including technical feedback and recommendations to improve reporting of accurate qualitative results, and ingesting the final product into the government-supplied tool to support risk assessment of NIST controls.

Collaboration and milestone execution

• Participate in Technical Interchange Meetings (TIMs) on a range of PMO security engineering topics.
• Participate in acquisition program engineering milestone reviews.
• Coordinate with Development contract personnel in Security, System Administration, System Engineering, and other supporting roles to identify, document, and plan security enhancement requirements, and resolve program security issues.
• Coordinate with inheritance providers (including enterprise teams and security offices such as SDDC, AMC, and DISA Security) to determine hybrid security requirements and establish appropriate inheritance relationships using provided tools.
• Coordinate security strategy with multiple agencies and Authorizing Official (AO) representatives.
• Coordinate with developers, vendors, and government organizations/agencies to assess security engineering issues.

Working knowledge and technical focus

• Support operational security activities including risk mitigation, host security, encryption, intrusion detection, and VPN implementations, as well as viral detection.
• Support security lockdown and/or hardening of servers and network devices.
• Recommend changes to network and security architecture to improve security posture while meeting operational performance requirements.
• Recommend and/or support information system contingency planning and exercise support (including IR/Contingency Plan exercise support).

Requirements

• US Citizenship with an active DoW Secret or higher clearance.
• Bachelor’s degree in Computer Science, Cybersecurity, or equivalent Information Technology academic studies.
• Active IAM II Certification in Good Standing (examples: ISC2 CGRC, CompTIA Security X, ISACA CISM, ISC2 CISSP or associate, GIAC GSLC, EC-Council CCISO).
• 1+ years of Security Engineering experience as an ISSO, ISSM, SCA, or Cyber Security Analyst/Engineer.
• Experience developing/reviewing system authorization documentation in accordance with DoW RMF implementation.
• Experience participating in TIMs and acquisition program engineering milestone reviews.
• Experience coordinating with Development contract personnel and inheritance providers to identify security requirements and inheritance relationships.
• Experience using eMASS.
• Experience supporting PMO systems to align with applicable Executive Orders, Federal Policy, DoW regulations, USTRANSCOM requirements, and commercial best practice.
• Experience reviewing vulnerability scans with ACAS/Nessus, and using outputs to recommend mitigation/remediation and ingest actions in eMASS.
• Experience providing technical feedback on DISA STIGs/SRGs and supporting ingestion into government tools for NIST control risk assessment.
• Experience conducting and evaluating security testing activities including security assessments and audits.
• Experience coordinating overall security strategy with multiple agencies and AO representatives.

Technologies you’ll work with

• NIST, ISCM, STIG, SRG, RMF, A&A reporting, POA&M, eMASS
• DoW Enterprise Mission Assurance Support Service (eMASS), ACAS, Nessus, DISA STIGs/SRGs, FISMA, VPN

Working conditions

• Work is primarily performed in a professional office or government facility environment.
• Participation in classified discussions may be required consistent with clearance level.
• Collaboration with geographically dispersed stakeholders is expected.
• Standard business hours with occasional schedule flexibility to support mission needs.

How success is measured

Success is demonstrated through clearly defined, traceable requirements reflecting validated operational needs, well-facilitated stakeholder forums that drive timely decisions, and functional designs that enable development teams to deliver compliant, mission-aligned capabilities.

How work gets done at Paragon

Paragon emphasizes disciplined collaboration, accountability to mission outcomes, and respect for government processes. Analysts lead with preparation and clarity, facilitate structured decision-making forums, and ensure requirements are governed, documented, and traceable from operational need through delivery, with a focus on predictable execution, transparency, and stewardship of government resources.