McGough Construction is hiring a Senior Cybersecurity Engineer to design, implement, and continuously improve security controls across a broad technology landscape. The role supports on-premises and cloud environments, networks, endpoints, identity, applications, and data, with added focus on AI-enabled services and CMMC readiness. Working closely with the Manager, Cyber Security, this position drives security design reviews, strengthens technical controls, and helps maintain CMMC Level 2 / NIST SP 800-171 assessment readiness, including enclave operations.
This onsite role is based in Roseville, MN and offers a salary range of USD 130,000 to 170,000 per year. The position requires a Bachelor’s degree and 4+ years of progressive cybersecurity experience.
Responsibilities
- Design, implement, maintain, and improve security controls across on-premises, cloud, network, endpoint, identity, application, and data environments.
- Engineer cloud and identity protections, including security posture management, identity governance, privileged access management, conditional access, and Zero Trust controls using Microsoft Entra ID or comparable platforms.
- Optimize security tools, configuration baselines, access controls, and automation; coordinate remediation when controls do not meet approved technical requirements.
- Lead vulnerability management by prioritizing findings by risk and exposure and coordinating remediation and validation with system owners.
- Improve threat detection and monitoring through log-source onboarding, detection rules, alert tuning, investigation workflows, and security automation.
- Act as a senior technical resource during security incidents, supporting investigation, containment, recovery, lessons learned, and improvements to response playbooks.
- Secure employee use of public AI services, developer copilots, and AI-enabled SaaS using identity-, device-, risk-, and data-aware controls.
- Design and implement protections for internally developed AI workloads, including model APIs, retrieval-augmented generation pipelines, vector databases, agents, Model Context Protocol services, tools, credentials, and machine-to-machine access.
- Partner with application, AI/ML, and data governance teams to address sensitive-data flows, agent and tool permissions, source code and credential exposure, shadow AI, and identified AI security weaknesses.
- Manage the technical security of the CMMC enclave, including controlled unclassified information (CUI) boundaries and data flows, in-scope assets, access and device controls, secure configurations, logging, monitoring, and vulnerability remediation.
- Implement applicable CMMC Level 2 and NIST SP 800-171 technical controls and maintain supporting evidence, system security plan inputs, control descriptions, and assessment-ready artifacts.
- Track technical gaps, POA&M remediation, access reviews, audit-log coverage, and assessment findings; partner with governance, risk, and compliance stakeholders on assessment coordination, compliance determinations, and formal risk acceptance.
- Lead security architecture and design reviews for infrastructure, cloud services, applications, AI solutions, integrations, and major technology initiatives.
- Define technical security requirements for new and changing applications, cloud services, integrations, AI-enabled workflows, and infrastructure; guide owners in applying and verifying them.
- Develop reference architectures, secure design patterns, and technical guardrails; conduct threat modeling and recommend practical risk-reduction measures.
- Partner with development teams on secure software practices, application and API testing, secrets management, integration and vendor reviews, and remediation of security findings.
- Guide and mentor security analysts, engineers, infrastructure teams, application teams, and AI/ML partners on technical controls and secure practices.
- Lead cross-functional technical work during incidents, audits, security reviews, projects, and implementation of cybersecurity and AI security initiatives.
- Contribute to security architecture and AI security roadmaps, control maturity plans, technology selection, and risk priorities; evaluate emerging threats and recommend improvements.
- Escalate material weaknesses and provide documented technical input for formal risk-acceptance decisions.
- Develop and maintain security standards, procedures, configuration baselines, technical playbooks, and control implementation documentation.
- Maintain AI security standards for sanctioned use, sensitive-data handling, model and API access, agent and tool permissions, exceptions, and protection of source code, credentials, intellectual property, and customer information.
- Document CMMC enclave configurations, evidence, exceptions, and technical remediation status in coordination with governance, risk, and compliance stakeholders.
- Define and report measures of vulnerability remediation, detection and response coverage, AI policy effectiveness, control performance, incidents, exceptions, and audit-finding closure.
- Report CMMC enclave readiness, including control status, evidence completeness, access reviews, audit-log coverage, assessment findings, POA&M progress, and risks to ongoing compliance.
- Use trends and findings to recommend and track improvements to the organization’s security posture.
- Participate in special projects, emergency response activities, business continuity exercises, vendor reviews, and other cybersecurity or AI security initiatives as needed.
- Maintain current knowledge of cybersecurity and AI security threats, tools, techniques, and practices through training, research, industry engagement, and hands-on technical learning.
Requirements
- Bachelor’s degree in Cybersecurity, Information Security, Computer Science, Information Technology, Engineering, or a related field; equivalent experience may be considered.
- 4-7 years of progressive experience in cybersecurity engineering, security operations, infrastructure security, cloud security, or a related technical security role.
- Working knowledge of CMMC Level 2 and NIST SP 800-171 requirements, including CUI scoping, security control implementation, assessment evidence, POA&M remediation, and certification readiness activities.
Technologies
- SIEM, SOAR, EDR/XDR, vulnerability management
- Identity and access management, firewalls, IDS/IPS, Microsoft Entra ID, Zero Trust
- Cloud security posture management
- Model Context Protocol services, retrieval-augmented generation, vector databases, agents, model APIs, API security
- Secrets management, threat modeling, secure coding
- CMMC, NIST SP 800-171, CUI scoping, POA&M
Benefits
- Insurance coverage for medical, dental, vision, life, and disability
- Generous retirement plans
- Voluntary benefit plans
- Parental leave
- Substantial paid time off
- Holiday pay
Qualifications
Required: Bachelor’s degree in a related field (or equivalent experience may be considered), 4-7 years of progressive cybersecurity experience, and working knowledge of CMMC Level 2 and NIST SP 800-171 requirements including CUI scoping, security control implementation, assessment evidence, POA&M remediation, and certification readiness activities.
Preferred: 7+ years of progressive experience, a professional security certification such as CISSP, CISM, GIAC (including GCIH, GCIA), Security+, Azure Security Engineer Associate, AWS Security Specialty, or equivalent; experience with security frameworks and standards such as the NIST Cybersecurity Framework, NIST NICE Framework, CIS Controls, ISO 27001, or similar models; and experience leading AI security architecture, governance, or engineering for public AI services, developer copilots, or internally developed AI/ML workloads, including support for a CMMC Level 2 assessment and CMMC-focused training or credentials such as CCP or CCA.
Office and Travel
- Work is typically performed in an office or hybrid environment using standard business and technical security tools.
- Occasional travel may be required for business continuity exercises, audits, conferences, vendor meetings, incident response activities, or organizational meetings.
Physical Requirements
- Ability to sit for extended periods at a workstation and during meetings, including while traveling by plane or car.
- Ability to lift up to 20 pounds frequently as needed to move objects; dexterity to write and manipulate a computer keyboard and mouse; ability to hear and speak clearly; and ability to distinguish between colors on graphs and charts.
- Occasional visits to construction jobsites may expose the employee to dirt, dust, uneven surfaces, outdoor weather conditions, and extreme temperatures.
