Information Systems Security Engineer (ISSE)

Information Systems Security Engineer (ISSE)

Location: Annapolis Junction, MD

Eligibility: Candidate must possess an active TS/SCI with Full Scope Polygraph clearance

Job Description

What You'll Bring: A solid understanding of security practices and policies, plus hands-on vulnerability testing experience. Prior experience with classified IC dissemination platforms, IC information sharing rules, and IC markings standards is expected.

About the Team: You will join a high-performing team of Security Engineers supporting a large, significant program. The team focuses on improving system security architecture and strengthening cybersecurity capabilities across operational, test, integration, and development systems while solving complex, mission-critical issues.

About the Environment: This is a fast-paced, technically complex program supported by robust development, test, and production environments. The work involves systems with exacting interface, performance, and security requirements, including support for cross-domain capabilities and Security Verification Testing (SVT) of relevant Type 1 devices.

About Our Practices: The program executes using Agile practices aligned to the Scaled Agile Framework (SAFe) and follows DevOps best practices. Security execution is driven by the Risk Management Framework (RMF), including management of multiple System Security Plans (SSPs) across development, test, and production systems. The role also operates within classified Intelligence Community (IC) environments and requires familiarity with IC information sharing rules and the Intelligence Community Markings System Register and Manual standards.

Summary of What You'll Do:

• Support the introduction of new capabilities into a complex system with stringent interface performance, and security requirements
• Enhance system security architecture and cybersecurity capabilities across multiple environments (operational, test, integration, and development)
• Manage RMF-aligned SSPs for development, test, and production systems
• Manage and support cross-domain capabilities
• Support SVT activities for relevant Type 1 devices
• Perform hands-on vulnerability testing and contribute to day-to-day security engineering efforts across a wide range of activities

Responsibilities may include:

• Define and validate security requirements and establish security architecture and designs for large-scale, geographically distributed systems and interfacing components within a complex network environment.
• Ensure end-to-end implementation alignment by working closely with Systems Engineering, Test Engineering, and Integration teams so hardware and software architecture and implementations meet security requirements.
• Design and implement security architectures and enterprise security solutions to ensure consistent application of security policy across the environment.
• Recommend and develop security standards and technical solutions aligned to current and target security architecture.
• Assess threats, risks, and operational security posture throughout the system lifecycle, including evaluating the impact of new development and recommending and implementing enhancements.
• Lead and contribute to security governance activities including security planning, assessment, risk analysis, risk management, certification support, awareness activities, security control assessment, and continuous monitoring and other IA program support functions.
• Evaluate, review, and test critical software and identify and remediate security issues across the system.
• Audit and assess security configurations using common methodologies and tools, and provide configuration management for security-relevant software and system components.
• Propose, coordinate, implement, and enforce information systems security policies, standards, and methodologies across distributed components.
• Serve as a security architecture SME, collaborating daily with internal technical experts and providing guidance to Program Managers, customer technical POCs, and internal teams on significant security issues.
• Enable secure development practices by working with development teams to improve understanding of vulnerabilities, attack vectors, and remediation approaches.
• Participate in SAFe activities, including Program Increment (PI) Planning and related Agile ceremonies.
• Plan and conduct Security Verification Testing (SVT) for relevant Type 1 devices.

Required Qualifications:

• You must already have an active TS/SCI with a full scope polygraph. No exceptions and no sponsorship available
• 15 years of relevant experience AND a Master's degree in related discipline (e.g. Computer Science, Cyber Security, Information Assurance, Information Security System Engineering - Additional experience may be substituted for a degree.
• Strong understanding of security practices and policies, including hands-on vulnerability testing using customer tools.
• Proven experience applying the Risk Management Framework (RMF)
• Experience formulating, evaluating, and enforcing IT security policies
• Working knowledge of industry-standard security tools (Nessus, Nmap, Wireshark), plus practical experience with:
• • Hardware and software security implementations
  • Network and communication protocols
  • Encryption tools and techniques
  • Web services security
  • Experience hardening and securely configuring commonly used desktop and server operating systems
  • Ability to work across multiple systems and components at the same time in a variety of configurations
  • Strong written and verbal communication skills
  • Consistent commitment to best practices and process discipline (the unglamorous stuff that prevents outages)
  • Ability to plan and prioritize work, clearly explaining technical options and trade-offs
  • Ability to produce high-quality results independently and as part of a team in a fast-moving environment

Preferred Qualifications:

• DoD 8570 compliant with IASAE Level II or Level III
• Information Systems Security Engineering Professional (ISSEP) certification
• Certified Information Systems Security Professional (CISSP) certification
• Five (5) years of experience applying Defense-in-Depth principles and technologies, including:
• • Access control
  • Authorization
  • Identification and Authentication
  • Public key infrastructure (PKI)
  • Network and enterprise security architecture
  • Experience applying risk assessment methodologies to system development
  • Experience developing/implementing integrated security services management processes, e.g.
  • • Assessment and audit support for network penetration testing
    • Antivirus planning
    • Risk analysis
    • Incident response
    • Experience providing information-assurance support for application development, including system security certifications and project evaluations for firewall solutions encompassing design, development, and implementation.
    • Experience with penetration testing tools
    • Experience with scripting languages

Highly Preferred. Applicants with a background in Analytical Methods and Modeling, Signals Intelligence (SIGINT), and Cryptographic Key Management will receive special consideration

Start Date: Immediate start upon clearance crossover (positions are available now). We will offer positions to the best qualified candidates on a first-come, first serve basis.