Information Systems Security Engineer (ISSE)

Job Title: Information Systems Security Engineer (ISSE)

Location: Annapolis Junction, MD

Eligibility: Candidate must possess an active TS/SCI with Full Scope
Polygraph clearance

Job Description:

What You’ll Bring

A solid understanding of security practices and policies, plus hands-on
vulnerability testing experience. Prior experience with classified IC
dissemination platforms, IC information sharing rules, and IC markings
standards is expected.

About the Team

You will join a high-performing team of Security Engineers supporting a
large, significant program. The team focuses on improving system
security architecture and strengthening cybersecurity capabilities
across operational, test, integration, and development systems while
solving complex, mission-critical issues.

About the Environment

This is a fast-paced, technically complex program supported by robust
development, test, and production environments. The work involves
systems with exacting interface, performance, and security requirements,
including support for cross-domain capabilities and Security
Verification Testing (SVT) of relevant Type 1 devices.

About Our Practices

The program executes using Agile practices aligned to the Scaled Agile
Framework (SAFe) and follows DevOps best practices. Security execution
is driven by the Risk Management Framework (RMF), including management
of multiple System Security Plans (SSPs) across development, test, and
production systems. The role also operates within classified
Intelligence Community (IC) environments and requires familiarity with
IC information sharing rules and the Intelligence Community Markings
System Register and Manual standards.

Summary of What You’ll Do

- Support the introduction of new capabilities into a complex system
with stringent interface performance, and security requirements

- Enhance system security architecture and cybersecurity capabilities
across multiple environments (operational, test, integration, and
development)

- Manage RMF-aligned SSPs for development, test, and production
systems

- Manage and support cross-domain capabilities

- Support SVT activities for relevant Type 1 devices

- Perform hands-on vulnerability testing and contribute to day-to-day
security engineering efforts across a wide range of activities

Responsibilities may include:

- Define and validate security requirements and establish security
architecture and designs for large-scale, geographically distributed
systems and interfacing components within a complex network
environment.

- Ensure end-to-end implementation alignment by working closely with
Systems Engineering, Test Engineering, and Integration teams so
hardware and software architecture and implementations meet security
requirements.

- Design and implement security architectures and enterprise security
solutions to ensure consistent application of security policy across
the environment.

- Recommend and develop security standards and technical solutions
aligned to current and target security architecture.

- Assess threats, risks, and operational security posture throughout
the system lifecycle, including evaluating the impact of new
development and recommending and implementing enhancements.

- Lead and contribute to security governance activities including
security planning, assessment, risk analysis, risk management,
certification support, awareness activities, security control
assessment, and continuous monitoring and other IA program support
functions.

- Evaluate, review, and test critical software and identify and
remediate security issues across the system.

- Audit and assess security configurations using common methodologies
and tools, and provide configuration management for
security-relevant software and system components.

- Propose, coordinate, implement, and enforce information systems
security policies, standards, and methodologies across distributed
components.

- Serve as a security architecture SME, collaborating daily with
internal technical experts and providing guidance to Program
Managers, customer technical POCs, and internal teams on significant
security issues.

- Enable secure development practices by working with development
teams to improve understanding of vulnerabilities, attack vectors,
and remediation approaches.

- Participate in SAFe activities, including Program Increment (PI)
Planning and related Agile ceremonies.

- Plan and conduct Security Verification Testing (SVT) for relevant
Type 1 devices.

Required Qualifications

- You must already have an active TS/SCI with a full scope polygraph.
No exceptions and no sponsorship available

- 15 years of relevant experience AND a Master’s degree in related
discipline (e.g. Computer Science, Cyber Security, Information
Assurance, Information Security System Engineering

- Additional experience may be substituted for a degree.

- Strong understanding of security practices and policies, including
hands-on vulnerability testing using customer tools.

- Proven experience applying the Risk Management Framework (RMF)

- Experience formulating, evaluating, and enforcing IT security
policies

- Working knowledge of industry-standard security tools (Nessus, Nmap,
Wireshark), plus practical experience with:

- Hardware and software security implementations

- Network and communication protocols

- Encryption tools and techniques

- Web services security

- Experience hardening and securely configuring commonly used desktop
and server operating systems

- Ability to work across multiple systems and components at the same
time in a variety of configurations

- Strong written and verbal communication skills

- Consistent commitment to best practices and process discipline (the
unglamorous stuff that prevents outages)

- Ability to plan and prioritize work, clearly explaining technical
options and trade-offs

- Ability to produce high-quality results independently and as part of
a team in a fast-moving environment

Preferred Qualifications

- DoD 8570 compliant with IASAE Level II or Level III

- Information Systems Security Engineering Professional (ISSEP)
certification

- Certified Information Systems Security Professional (CISSP)
certification

- Five (5) years of experience applying Defense-in-Depth principles
and technologies, including

- access control

- authorization

- Identification and Authentication

- public key infrastructure (PKI)

- network and enterprise security architecture

- experience applying risk assessment methodologies to system
development

- Experience developing/implementing integrated security services
management processes, e.g.

- assessment and audit support for network penetration testing

- antivirus planning

- risk analysis

- incident response

- Experience providing information-assurance support for application
development, including system security certifications and project
evaluations for firewall solutions encompassing design, development,
and implementation.

- Experience with penetration testing tools

- Experience with scripting languages

Highly Preferred. Applicants with a background in Analytical Methods and
Modeling, Signals Intelligence (SIGINT), and Cryptographic Key
Management will receive special consideration

Start Date. Immediate start upon clearance crossover (positions are
available now). We will offer positions to the best qualified candidates
on a first-come, first serve basis.