Pennsylvania

Cybersecurity Jobs in Pennsylvania

43 jobs found

Include remote jobs

Today

Cyber Security Engineer

Penn State University Warminster, PA

Warminster, PA

Today

$92k - $175k/yr Full time Certification And Accreditation Cyber Security Cybersecurity Tools

Apply Now

Job Description

Penn State’s Applied Research Laboratory (ARL) is looking for a Cyber Security Engineer to help protect research data and systems through proactive security measures, risk assessment and action, and compliance-focused support for work conducted for the Navy, DoD, and the Intel Community. This hybrid role includes on-site work in Warminster, PA.

The position supports secure operations in an environment that includes Unclassified, Controlled Unclassified Information (CUI), and Classified information. You will contribute to security planning, continuous monitoring, and technical security activities that help sustain trust and readiness across research and operational environments.

What you’ll do

Support the development, validation, and submission of information system security plans, security test and evaluation plans, certification and accreditation or authorization packages, and plans of action and milestones for compliance requirements
Participate in conducting, developing, planning, and coordinating risk assessments for information systems in development, test, production, and research environments based on established or newly determined compliance and audit needs
Complete technical security tasks for networks and systems including vulnerability scanning, review of security and event logs, network analysis, security configuration review, and incident response when needed
Administer and harden DISA STIG compliant Windows/Linux environments across physical and virtual systems, including provisioning, patching, baseline management, and managing AD accounts and groups
Operate and maintain virtualization platforms such as VMware and Hyper-V, including creating VMs/templates/snapshots, monitoring resources, and optimizing performance
Perform basic network administration (ports, VLANs, port security), monitor system and network health, respond to alerts, conduct root-cause analysis, and remediate issues
Support continuous monitoring by deploying Splunk universal forwarders, ensuring log ingestion health, and developing searches, alerts, and dashboards for operations and cyber use

Required experience and knowledge

Strong practical technical experience across multiple operating systems and technology types, with the ability to audit against compliance requirements
Knowledge and application of NIST 800-171, NIST 800-53, NISPOM, DAAG, and other regulatory requirements
Experience with security plan development and/or continuous monitoring tied to security plans
Strong system and network administration skills
Active security clearance at the Top Secret level or higher
Effective analytical, problem-solving, and communication skills
Strong organizational and multitasking abilities, with aptitude to work independently, as part of a team, and across multiple teams and disciplines
U.S. citizen to apply
Completion of background check(s) is required in accordance with University policies
Must be eligible to obtain a government security clearance, participate in the ARL drug testing program, and comply with electronic and physical monitoring requirements applicable to federal contractors

Tools and technologies you’ll work with

DISA STIG, Windows, Linux
VMware, Hyper-V, VMs/templates/snapshots
AD accounts/groups
Splunk universal forwarders, Splunk, ELK
NIST 800-171, NIST 800-53
NISPOM, DAAG, CUI

Compensation and benefits

Salary range: $92,100 - $174,708 per year (including all possible grades)
Comprehensive medical, dental, and vision coverage
Robust retirement plans
Substantial paid time off including holidays, vacation, and sick time
75% tuition discount for employees, and available to eligible spouses and children

Position specifics

Hybrid work schedule with on-site presence in Warminster, PA and work from home
Questions related to flexible work should be directed to the hiring manager during the interview process
Approval of remote and hybrid work is not guaranteed regardless of work location

Notice for ARL onsite work: ARL operates in a secure information environment involving Unclassified, CUI, and Classified information. Personal electronic devices brought onsite must be registered and may be restricted from certain areas.

Campus reporting: Penn State publishes a combined Annual Security and Annual Fire Safety Report (ASR), which includes crime statistics and institutional policies. The ASR is available for review here.

Required education: Bachelor’s Degree

Level guidance (depending on fill):

ARL Advanced Professional: Bachelor’s Degree and 3+ years of relevant experience (or an equivalent combination of education and experience accepted)
ARL Intermediate Professional: Bachelor’s Degree and 1+ years of relevant experience (or an equivalent combination of education and experience accepted)

View full job page →

3d ago

Application Security Engineer, Information Security

Ascensus Dresher, PA

Dresher, PA

3d ago

Full time Application Security Data Security DevSecOps

Apply Now

Job Description

Ascensus is hiring an Application Security Engineer to strengthen its application security program and support secure delivery across the software development lifecycle. In this onsite role in Dresher, PA, you will act as a trusted advisor to scrum teams, helping build security into development practices through DevSecOps and ongoing security analysis.

What you’ll do

Protect and ensure proper handling of all confidential data to prevent unauthorized access, improper transmission, and unapproved disclosure.
Bring Ascensus service philosophy and Core Values (People Matter, Quality First, and Integrity Always®) into day-to-day execution.
Partner with security and development leadership to develop a comprehensive, agile, and innovative DevSecOps approach across all phases of the SDLC, identifying and managing risk.
Provide security consultation to scrum teams, application owners, and technology teams on relevant security controls and secure SDLC process.
Participate in sprint planning and decision-making sessions to ensure security requirements and considerations are incorporated into development practices.
Perform application security analysis, including architecture review, data flow analysis, support for penetration testing, and threat modeling.
Build and monitor compliance with application security policies, coding standards, and security controls to mitigate threats.
Own deployment and integration of services that support SAST, DAST, and SCA. Support development teams with static and dynamic testing, triage findings, and provide remediation guidance when needed.
Assist with other tasks and projects as assigned.

What you bring

Minimum 7 years of experience in Secure Software Development and/or DevSecOps (preferred).
Ability to define software security and privacy requirements.
Solid understanding of threat modeling, risk, and mitigation from internal and external threats.
Experience developing system security architecture diagrams and security architecture specifications aligned to security architecture standards.
Experience conducting software security design reviews.
Experience running software security testing tools in a CI/CD pipeline, including Static and Dynamic Application Security Testing and SCA.
Hands-on experience with application testing tools such as Burp Suite, Fiddler, ZAP, Wireshark, and Metasploit.
Experience configuring WAF, API Gateway, and API security tools.
Knowledge of common application and API security risks, including OWASP Top 10 and SANS/CWE Top 25.
Solid understanding of application, database, and network vulnerability testing principles.
Working knowledge of Microsoft SDL, OWASP SAMM, or BSIMM.
Experience assessing secure adoption of third-party components, including open source and commercial software.
.NET/Java experience is a plus.
Understanding of information security frameworks such as ISO27001, NIST, and CSA, and working in regulated environments against FFIEC, SEC, and/or HIPAA requirements.
Strong understanding of authentication and authorization systems and cryptographic standards (encryption, hashing, key management, digital signatures, etc.).
Ability to provide vulnerability remediation guidance and mentor product development software engineers.
Ability to translate security risks into business impact.
Experience running or managing vulnerability assessments using automated tools (for example Nessus, Qualys) and managing penetration testing engagements.
Understanding of privacy regulations related to handling and protecting information.
Experience with fraud detection and analysis as it relates to custom developed applications.
Experience integrating automated testing tools into CI/CD pipelines.
Experience implementing cloud security controls using CSA or cloud provider best practices (such as Azure and AWS).
Experience implementing and supporting security automation tools, including K8 and cloud platform configuration, hardening, and monitoring.

Relevant tools and technologies

SAST, DAST, SCA, Burp Suite, Fiddler, ZAP, Wireshark, Metasploit, WAF, API Gateway, Nessus, Qualys, .NET, Java, ISO27001, NIST, CSA, FFIEC, SEC, HIPAA, OWASP Top 10, SANS/CWE Top 25, Microsoft SDL, OWASP SAMM, BSIMM, CI/CD, DevSecOps, SDLC, K8, Azure, AWS.

View full job page →

4d ago

Experienced Security Analyst

iPipeline Wayne, PA

Wayne, PA

4d ago

Full time Cloud Platforms Cyber Essentials Cyber Security

Apply Now

Job Description

Join iPipeline in Wayne, PA (onsite) as an Experienced Security Analyst, where you’ll help protect systems and data while strengthening the organization’s incident readiness and compliance posture. The role combines hands-on security monitoring, in-depth incident investigation, and security tool management, with opportunities to contribute to planning and reporting across teams. iPipeline offers a competitive compensation and benefits package, career growth opportunities, an employee stock purchase plan, 401(k), and company-matched retirement packages, plus generous time off and flexible work/life balance, an employee wellness program, and an awards and recognition program.

What you’ll do

Monitor and assess security alerts and system events, identifying potential risks, threats, and vulnerabilities across systems and infrastructure.
Implement and refine security controls to mitigate risk and continually improve the organization’s security posture.
Perform regular security audits and assessments, including vulnerability scanning and penetration testing.
Detect, analyze, and investigate security incidents to determine root cause, impact, and appropriate next steps.
Develop and implement remediation strategies for confirmed incidents, ensuring breaches are documented, analyzed, and remediated.
Manage in-scope security tools and continuously evaluate and upgrade them to address evolving threats and compliance requirements.
Coordinate with external vendors or authorities during major incidents such as data breaches.
Apply security frameworks and practices to meet industry regulations, laws, and standards related to data protection, privacy, and industry requirements.
Keep current on regulatory changes and help adjust policies and practices accordingly.
Partner with legal teams to ensure contracts and agreements (including third-party vendor arrangements) meet security and regulatory expectations.
Coordinate with audit teams for internal and external audits, including maintaining audit schedules and tracking remediation efforts.
Interpret and apply regulatory and audit standards (including SOC 2, SOX, and Cyber Essentials), identify compliance gaps, and propose corrective actions.
Conduct risk assessments and evaluate control effectiveness, supporting ongoing governance and improvement.
Assist with employee security training sessions and collaborate with legal, HR, and IT to support consistent security practices.
Provide regular reporting to senior management on security and compliance posture.
Create detailed documentation for audits and compliance reviews, and update and maintain security policies and procedures.
Lead portions of internal audits and participate in external audits.
All other duties as assigned.

What you bring

Ability to assess and mitigate advanced threats such as malware, phishing, and APTs.
Experience conducting forensic analysis on compromised systems and networks.
Proficiency in handling and responding to security incidents and breaches.
Understanding of regulatory frameworks including GDPR, HIPAA, SOC 2, PCI DSS, NIST, and ISO 27001.
Proficiency with network security, cloud security, encryption techniques, firewalls, SIEM (Security Information and Event Management), vulnerability scanning tools, and other security technologies.
Strong written and verbal communication skills for reporting findings and collaborating with teams.

Tools and standards you’ll work with

SIEM (Security Information and Event Management), vulnerability scanning tools, firewalls, network security, cloud security, encryption techniques, and the standards/frameworks including GDPR, HIPAA, SOC 2, PCI DSS, NIST, ISO 27001, SOX, and Cyber Essentials.

View full job page →

4d ago

Product Systems Security Engineer

Lutron Electronics Co., Inc Coopersburg, PA

Coopersburg, PA

4d ago

Full time Automated Security Testing Burp Suite Cloud Platforms

Apply Now

Job Description

In the Product Systems Security Engineer role at Lutron Electronics Co., Inc, you will help shape the cybersecurity of Lutron products, systems, and processes. The position focuses on building security into scalable lighting control solutions and aligning security outcomes with customer and compliance expectations.

Role Responsibilities

Design, test, and validate the cybersecurity of Lutron products, systems, and processes
Translate customer and compliance security requirements for developers, team leaders, and executives
Collaborate across disciplines including software development, sales, legal, and operations
Integrate security into scalable lighting control systems deployed for residential and commercial applications
Work as part of a dedicated security team responsible for organization-wide security initiatives
Develop proficiency across a range of technologies, including IoT Devices, AWS Cloud, Azure Cloud, BurpSuite, Amp, and Vigiles

Required Qualifications

PhD degree in Cybersecurity, or in Computer Science, Computer Engineering, Software Engineering, Information Assurance, Information Systems, or Information Security
Minimum cumulative GPA of 3.00 for each degree earned
Ability and willingness to travel 10-15% for inter-office collaboration and site visits
Authorization to work in the U.S. with no requirement for Lutron sponsorship for a work visa (including H-1B), now or in the future
Availability to work onsite 5 days per week

Technologies and Tools

IoT Devices
AWS Cloud
Azure Cloud
BurpSuite
Amp
Vigiles

Additional Role Overview

As a Product Systems Security Engineer, you will contribute from the beginning to high-impact work that supports Lutron’s leadership in smart lighting and shading systems. The role is structured around cross-functional execution, with an emphasis on applying cybersecurity practices throughout the product lifecycle.

Your team environment includes on-the-job training, supervision by industry experts, and opportunities to attend workshops. As you develop, you may build technical depth through additional expertise or pursue engineering management paths. Growth opportunities may also extend to areas such as product management, manufacturing, quality, and operations.

Product Systems Security Engineers participate with cross-functional teams to conceptualize, design, and develop secure, high-quality consumer products and services for commercial and residential use. The role also involves evaluating cybersecurity practices and direction, contributing improvements from within the team.

Throughout the lifecycle, you may engage with technical areas including DevSecOps and secure design lifecycle, security incident response, security architecture, design, and testing, certificate chains, Customer Identity and Access Management (CIAM), security governance including policies and procedures, and securing Artificial Intelligence.

Location and Work Style

Coopersburg, PA
Onsite role (5 days per week)

View full job page →

5d ago

Senior Aerospace Cybersecurity Engineer

Katalyst Healthcares & Life Sciences Pittsburgh, PA

Pittsburgh, PA

5d ago

Full time Senior Aerospace Aerospace & Defense

Apply Now

Job Description

Pittsburgh, PA (onsite) is the backdrop for this Senior Aerospace Cybersecurity Engineer (Hardware) role, where you will help shape cybersecurity outcomes for aerospace and defense programs. The position combines hands-on technical work with customer-facing collaboration, supporting hardware security and compliance across embedded systems, controllers, and aircraft platforms.

As a senior engineer with aerospace-focused experience, you will lead key cybersecurity activities end-to-end, from threat modeling and security architecture reviews to testing, vulnerability assessments, and support for secure development processes.

Responsibilities

Lead cybersecurity activities for aerospace and avionics programs.
Perform threat modeling, risk assessments, and security architecture reviews.
Support secure software development, including code signing, cryptography, secure boot, and secure firmware update processes.
Conduct cybersecurity testing, vulnerability assessments, and penetration testing.
Define cybersecurity measures for aerospace embedded systems, controllers, and aircraft platforms.
Support compliance with aerospace and federal cybersecurity requirements.
Review customer requirements, RFIs/RFQs, and contribute to proposal development.
Interface with customers, federal contractors, and internal engineering teams.
Support lab-based testing and occasional on-site assessments at customer and aircraft locations.

Requirements

8+ years of cybersecurity engineering experience.
3+ years of aerospace cybersecurity experience.
Aerospace threat modeling and risk assessments.
Embedded systems security.
Cryptography and code signing.
Vulnerability management.
Secure Development Lifecycle (SDLC).
Hardware security and root-of-trust concepts.
Familiarity with aerospace cybersecurity standards such as DO-326A / ED-202A, DO-356A, NIST Cybersecurity Framework, and FIPS 140-3.
Experience supporting ITAR-controlled and/or federal aerospace programs.

Tools & Technologies

DO-326A / ED-202A, DO-356A
NIST Cybersecurity Framework
FIPS 140-3
Secure Development Lifecycle (SDLC)
Cryptography, code signing
Secure boot, secure firmware update processes
Threat modeling, risk assessments, penetration testing
Vulnerability management, root-of-trust concepts
ITAR

Preferred Qualifications

Experience supporting FAA, DoD, defense, or commercial aerospace programs.
Knowledge of aircraft control systems, avionics, and aerospace hardware security architectures.

View full job page →

28d ago

Senior Application Penetration Tester

Chubb Philadelphia, PA

Philadelphia, PA

28d ago

Full time Senior Ai Enabled Security Ai Security

Apply Now

Job Description

Senior Application Penetration Tester focuses on planning and executing security testing across modern application types, then driving remediation visibility and risk reporting to technical and executive stakeholders.

Responsibilities

Plan and conduct penetration tests for web, mobile (iOS & Android), APIs, cloud-native/containerized systems, and AI/LLM-integrated applications
Assess AI/ML and generative AI features for risks including prompt injection, insecure output handling, training data poisoning, model denial of service, and sensitive information disclosure using guidance aligned to OWASP Top 10 for LLM Applications and MITRE ATLAS
Collaborate with AI/ML engineering and data science teams to threat-model AI-powered features and embed security testing into MLOps and CI/CD pipelines
Evaluate cloud-native and containerized workloads and Infrastructure as Code for misconfigurations and weak security controls across AWS, Azure, GCP, Docker, and Kubernetes
Test modern API architectures including REST, GraphQL, and gRPC, with attention to OAuth2, OIDC, and JWT authentication/authorization flaws and microservices-based applications
Perform mobile application security testing and reverse engineering, including analysis for hardcoded credentials, insecure keychain storage, and anti-emulator/obfuscation bypass
Own overall vulnerability remediation status for the global application portfolio and act as a primary contact for application teams on remediation
Manage application risk rating processes and support timely risk scoring for new and changing applications
Build and maintain dashboards and status reports for portfolio leads and CIOs, including follow-up on overdue vulnerabilities to meet compliance timelines
Create clear, actionable penetration test reports and communicate findings and a remediation strategy to both technical and executive stakeholders
Research emerging attack techniques and tooling, and drive automation and process improvements across the testing program

Requirements

Prior experience managing Information Security projects
Bachelor’s Degree in Computer Science, Engineering, or another Engineering or Technical discipline, or equivalent relevant experience
Minimum 2 years of professional experience performing penetration testing for web application, API endpoint, and mobile (iOS & Android)
Knowledge of prioritizing remediation activities with operational teams using risk ratings of vulnerabilities and assets
Knowledge of vulnerability management standards, including CVE and CVSS
Knowledge across network security, wireless security, application security, infrastructure hardening and security baselines, and web server and database security
Knowledge of penetration testing principles, tools, and techniques
Working experience with industry frameworks such as OWASP, OWASP API Security Top 10, OWASP Top 10 for Large Language Model (LLM) Applications, NIST, NIST AI Risk Management Framework, and MITRE ATT&CK
Comfort working outside comfort zone with willingness to learn
Excellent verbal and written communication skills
Strong analytical skills
Strong team player with ability to work independently
Strong project management skills and ability to multi-task
Self-motivated with strong initiative
Knowledge of computer networking concepts and protocols and application security methodologies
Skill in performing impact/risk assessments
Familiarity with modern application architectures including cloud-native (AWS, Azure, GCP), containerized (Docker, Kubernetes), microservices, and API-first designs (REST, GraphQL, gRPC)
Foundational understanding of AI/ML and generative AI security risks such as prompt injection, model manipulation, and sensitive data leakage is a plus

Technologies

AWS, Azure, GCP, Docker, Kubernetes, Infrastructure as Code
REST, GraphQL, gRPC, OAuth2, OIDC, JWT
MLOps, CI/CD
OWASP, OWASP API Security Top 10, OWASP Top 10 for Large Language Model (LLM) Applications, OWASP Top 10 for LLM Applications
NIST, NIST AI Risk Management Framework, MITRE ATT&CK, MITRE ATLAS
CVE, CVSS
Kali Linux, Metasploit, Nmap, Burp Suite, OWASP ZAP, Santoku
Genymotion, APKTool, JD-GUI, SQLMap, Semgrep, Snyk, Checkmarx, AppScan, Veracode
Trivy, Grype, Prowler, ScoutSuite, Garak, PyRIT, OWASP ASVS
OSCP, OSWE, GWAPT, GPEN, CEH, GCPN, CCSP
LangChain, Semantic Kernel, AutoGen, RAG vector databases

Location: Philadelphia, PA (onsite)

View full job page →

28d ago

Cybersecurity Analyst

GEM Technology, Inc. West Mifflin, PA

West Mifflin, PA

28d ago

$110k - $150k/yr Contract Cybersecurity Tools Fedramp Information Security

Apply Now

Job Description

Cybersecurity subcontractor role supporting National Institute of Standards and Technology (NIST) Risk Management Framework (RMF) deliverables in an onsite environment.

Responsibilities

Support and execute NIST RMF directives across the full RMF workflow.
Assist information system owners with development of System Security Plans (SSPs) and Security Assessment Reports (SARs) to support information system authorization.
Use the existing RSA Archer application on Naval Nuclear Propulsion Network (NNPP Net) to complete authorization package tasks.
Support creation of Plans of Action and Milestone (POA&Ms) and Risk Based Decisions (RBDs) for deficiencies identified during the authorization process.

Requirements

4+ years combined experience in one or more of the following roles: security control validator, security control assessor, Information System Security Officer (ISSO), or Information System Security Manager (ISSM).
2+ years supporting development of information system security authorization packages aligned to NIST 800-37, NIST 800-53, and NIST 800-53a under RMF.
2+ years experience working with FedRAMP.
CompTIA Security+ certification.
US citizen only. Applications from Visa or Green Card holders are not accepted at this time.
Department of Energy Q Clearance required, or ability to obtain.

Key Technologies

RSA Archer application
NNPP Net (Naval Nuclear Propulsion Network)
RMF
NIST 800-37, NIST 800-53, NIST 800-53a
FedRAMP

Location

West Mifflin, PA (onsite)
Schenectady, NY (onsite)
Positions to be filled: one candidate at each location, or both candidates at a single location.
Preferred: West Mifflin, PA 15122

Work Schedule / Telework

25% teleworking
75% onsite required in West Mifflin, PA and/or Schenectady, NY
25% willingness to travel (required)
In person work location

Security Clearance & Timing

Department of Energy Q Clearance needed or ability to obtain.
Start date will be delayed until clearance is approved (could be 6 months or longer).
Security clearance requirement listed as Top Secret (Required).