Cyber Security Engineer

Bespoke Technologies, Inc.; Herndon, Northern (VA, KY); On-site; USD 120,000 - 170,000; Full time

Job summary

Bespoke Technologies, Inc. in Herndon, VA seeks a Cyber Security Engineer with active Poly clearance for on-site work. The role focuses on security assessments of cloud infrastructure, collaboration with cloud providers, and RMF-based risk management.

Candidates should demonstrate experience with A&A, POA&Ms, and security architecture reviews. The position requires strong project management, technical reporting, and the ability to produce leadership-ready briefs on security posture and program

Qualifications

• Experience conducting security assessments for cloud infrastructure/services.
• Experience facilitating TEMs with cloud service providers to review cloud architectures.
• Experience designing/reviewing systems using cloud platforms (AWS, Oracle Cloud, Google Cloud, or Azure).
• Experience with cross-domain technology and common architecture designs.
• Experience with continuous monitoring and scan analysis using common tools (Rapid7, Nessus, Qualys).
• Experience closing POA&Ms and tracking assessment activities with compliance tools (Xacta 360, Risk Vision, RSA Archer).
• Familiarity with NIST RMF, security control assessments, and preparing security packages for SCAs.
• Experience information system security engineering activities and project management including milestones and metrics.

Responsibilities

• Lead security assessments for cloud-based systems and services.
• Coordinate with cloud providers to review architectures and ensure compliance.
• Develop and maintain program metrics, performance indicators, and dashboards for leadership.
• Prepare technical reports, status briefings, and leadership communications.

Skills

Security assessments

Cloud security

POA&Ms

NIST RMF

Project management

Tools

Xacta 360

Risk Vision

RSA Archer

Nessus

Rapid7

Qualys

Job description

BT-370 – Cyber Security Engineer

Herndon, VA (fully on-site, no remote option)

Please do NOT apply if you do not have an active Poly clearance. Those without a Poly will not be considered.

Required:

• Demonstrates experience conducting security assessments, particularly for cloud infrastructure and cloud services.
• Demonstrates experience facilitating TEMs with cloud service providers to review cloud service architectures
• Demonstrates experience designing, implementing, assessing or reviewing systems that utilize cloud technology with either Amazon Web Services, Oracle Cloud, Google Cloud, or Microsoft Azure cloud architecture.
• Demonstrates experience utilizing or reviewing cross domain technology and common architecture designs.
• Demonstrates experience with continuous monitoring requirements to include scan analysis for critical or high findings with common scan tools such as Rapid 7, Nessus, and Qualys.
• Demonstrates experience monitoring or closing Plan of Action and Milestone items (POA&Ms).
• Demonstrates experience utilizing compliance tools to track assessment and authorization activities such as Xacta 360, Risk Vision, RSA Archer.
• Demonstrates experience with the common control provider concept within the NIST Risk Management Framework.
• Demonstrates experience with security control assessments to include working with SCAs and preparing security packages for SCAs.
• Demonstrates experience conducting information system security engineering activities.
• Demonstrates project management experience including project planning, task tracking, milestone management, and resource coordination
• Demonstrates experience developing and maintaining program metrics, performance indicators, and compliance status dashboards
• Demonstrates experience preparing technical reports, program highlights, status briefings, and leadership communications

Desired:

• Skills and Demonstrates knowledge that are highly desired but not required to perform the work include:
• Demonstrates experience using the Sponsor’s or IC element A&A process.
• Demonstrates experience creating or reviewing A&A body of evidence documentation in a cloud security environment.
• Demonstrates experience identifying, implementing, or reviewing appropriate information security controls.
• Demonstrates experience working in Xacta 360