Cybersecurity Engineer

nooks; El Segundo (CA); On-site; USD 145,000 - 163,000; Full time

Benefits offered by this job

Performance bonus

Equity

Medical benefits

Dental benefits

Vision benefits

PTO

401(k)

Job summary

Nooks is seeking a Cybersecurity Engineer to own the security posture of our unclassified environment, implementing NIST SP 800‑171 and CMMC Level 2 controls, and producing audit evidence for external assessments. You will lead self‑assessments, manage POA&M workflows, and coordinate with IT/Cyber teams to ensure continuous compliance.

The role requires DoD IAM Level II/III certification and deep knowledge of security controls, Google Workspace security, and data protection, with a focus on

Qualifications

• U.S. citizenship required for access to CUI/ITAR data.
• 5–8 years in cybersecurity with at least 3 years on NIST SP 800-171 compliance.
• Experience configuring and securing Google Workspace in regulated environments.
• Ability to conduct technical self‑assessments and audit readiness.
• Deep understanding of DFARS 252.204‑7012/7019/7020, NIST SP 800‑171, and CMMC Level 2.
• Active DoD 8570/8140 IAM Level II or III certification (e.g., CISSP, CISM, CASP+, or CAP).
• Strong ability to explain technical requirements to non‑technical leadership and document controls for external auditors.

Responsibilities

• Own the unclassified environment's compliance posture and maintain the SSP against NIST SP 800‑171 and CMMC Level 2.
• Track findings and POA&Ms and drive timely remediation.
• Generate and maintain SPRS scores and identify gaps ahead of assessments.
• Adhere to Change Management and the Change Control Board (CCB).
• Plan and execute self‑assessments of the unclassified network as internal auditor.
• Lead preparation for C3PAO assessments and ensure audit readiness.
• Document controls clearly for external auditors and translate requirements for leadership.
• Secure Google Workspace and Microsoft environments with SoD and secure remote access configurations.
• Ensure DLP, access controls, and MDM meet CUI protection requirements.
• Monitor for configuration drift against the CUI baseline.
• Serve as cybersecurity point of contact for evaluating new enterprise software.
• Evaluate compliance posture of third‑party tools, software and vendors to preserve the chain of trust.

Skills

NIST SP 800-171

CMMC Level 2

Auditing & assurance

Technical writing

Compliance governance

Google Workspace security

Education

DoD 8570/8140 IAM Level II or III

CISSP/CISM/CASP/CAP

CCP or RP

Tools

Google Workspace

Microsoft 365 Security

Endpoint management

Job description

Nooks is pioneering Classified-Infrastructure-as-a-Service (CIaaS) — designing, building, and operating Sensitive Compartmented Information Facilities (SCIFs) and other secured, classified environments for the defense and national security community. We work with the agencies, contractors, and mission-driven organizations that keep the nation safe, delivering the physical infrastructure that makes classified work possible. We’re growing fast, operating across multiple markets, and building a company that takes both the mission and the business seriously.

About the Role

As Cybersecurity Engineer, you own the security posture of Nooks' own unclassified environment — hardening it, assessing it against the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171 and the Cybersecurity Maturity Model Certification (CMMC), and keeping the evidence that proves it. Our classified infrastructure gets the headlines, but protecting Controlled Unclassified Information (CUI) is equally critical to the mission and to partner trust. This is a hands‑on, individual-contributor role reporting to the Cyber Compliance and Policy Manager in IT/Cyber: you run the compliance program and do the technical work behind it, assessing, hardening, and certifying the estate the IT team builds and operates. Your focus is Nooks' own environment, including the customer facing unclassified network deployed at all Nooks facilities.

Ownership is defined, but the program is still being built: controls need tuning, evidence needs automating, and priorities shift as new tools and vendors enter the environment. This is a "player‑coach" role — you set the cadence, run the deep‑dive self‑assessments and internal audits yourself, and step in wherever the unclassified environment's security needs you, translating NIST controls into practical configurations rather than waiting for perfect requirements.

Key Responsibilities

NIST 800-171 Compliance & Governance

• Own the unclassified environment's compliance posture and maintain the System Security Plan (SSP) against NIST SP 800-171 and CMMC Level 2.
• Track findings and vulnerabilities and manage Plans of Action & Milestones (POA&Ms) to drive timely remediation.
• Generate and maintain SPRS scores, identifying gaps ahead of third‑party assessment.
• Strictly adhere to Change Management processes and the Change Control Board (CCB), ensuring all infrastructure modifications are thoroughly validated and tested prior to production deployment.

Self‑Assessment & Audit Readiness

• Independently plan and execute comprehensive self‑assessments of the unclassified network, acting as internal auditor to validate control effectiveness.
• Lead preparation for C3PAO assessments — compile evidence, interview technical staff, and keep the environment audit‑ready at all times.
• Document controls clearly for external auditors and translate requirements for non‑technical leadership.
• Secure and monitor both Google Workspace and Microsoft environments (Active Directory, Group Policy), ensuring proper Separation of Duties (SoD) and secure remote access configurations.
• Ensure Data Loss Prevention (DLP), access controls, and mobile device management (MDM) meet CUI protection requirements.
• Continuously monitor for configuration drift against the CUI baseline.
• Serve as the primary cybersecurity point of contact for evaluating new enterprise software introductions.
• Assess compliance requirements so new tools meet network‑specific security standards and organizational policy.
• Evaluate the compliance posture of third‑party tools, software and vendors to preserve the chain of trust.

What Success Looks Like in This Role

Within the first year, Nooks' unclassified environment has a current, accurate SSP and a defensible SPRS score, with gaps identified and driven to closure through POA&Ms before any third‑party assessment. Self‑assessments run on a regular cadence, and the Google Workspace environment is configured and monitored so DLP, access controls, and MDM demonstrably protect CUI. The environment is audit‑ready at all times, and when a C3PAO assessment comes, evidence and artifacts are organized and complete. New software and vendors are vetted for compliance before they enter the environment, preserving the chain of trust. Leadership relies on this role as the authoritative source of truth for the unclassified compliance posture.

Cross‑Functional Expectations

This role partners closely and collaboratively with Enterprise IT to secure and monitor the Google Workspace and Microsoft environments and with IT/Cyber Operations to remediate findings across the unclassified estate. It serves as the cybersecurity point of contact for teams across Nooks introducing new software, and provides evidence and technical answers to external C3PAO assessors during audits. It executes on the compliance program owned by the Cyber Compliance and Policy Manager and reports posture and risk up through Enterprise Cyber.

The Skillset

Required

• U.S. citizenship (a compliance requirement for accessing CUI/ITAR data).
• 5–8 years in cybersecurity, with at least 3 years focused specifically on NIST SP 800-171 compliance and implementation.
• Demonstrated experience configuring and securing Google Workspace in a regulated environment, including compliance controls across Drive, Gmail, and endpoint management.
• Proven ability to conduct technical self‑assessments — comfortable acting as an auditor, testing controls, and gathering evidence without supervision.
• Deep understanding of DFARS 252.204‑7012/7019/7020, NIST SP 800‑171, and CMMC Level 2 assessment guides.
• Active DoD 8570/8140 IAM Level II or III certification (e.g., CISSP, CISM, CASP+, or CAP).
• Strong ability to explain technical requirements to non‑technical leadership and document controls clearly for external auditors.

Preferred

• CMMC Certified Professional (CCP) or Registered Practitioner (RP).
• Google Professional Cloud Security Engineer or Professional Google Workspace Administrator certification.
• Active Secret or Top Secret clearance (a plus; this role focuses on the unclassified environment).
• Experience functioning as a formal security control assessor (SCA) or QSA.
• Familiarity with detection and incident‑response tooling — endpoint detection and response (EDR) and security information and event management (SIEM).
• Performance bonus
• Equity
• Benefits: Medical, dental, vision, PTO, and 401(k).

Eligibility & Clearance

Candidates must be U.S. citizens (a compliance requirement for accessing CUI/ITAR data) and authorized to work in the United States. This role supports the unclassified environment; an active security clearance is not required, though a Secret or Top Secret clearance is a plus.

Salary Range for all departments

Salary Range

$145,000 - $163,000 USD

Voluntary Self-Identification

For government reporting purposes, we ask candidates to respond to the below self‑identification survey. Completion of the form is entirely voluntary. Whatever your decision, it will not be considered in the hiringprocess or thereafter. Any information that you do provide will be recorded and maintained in aconfidential file.

As set forth in Nooks’s Equal Employment Opportunity policy,we do not discriminate on the basis of any protected group status under any applicable law.

If you believe you belong to any of the categories of protected veterans listed below, please indicate by making the appropriate selection. As a government contractor subject to the Vietnam Era Veterans Readjustment Assistance Act (VEVRAA), we request this information in order to measurethe effectiveness of the outreach and positive recruitment efforts we undertake pursuant to VEVRAA. Classification of protected categoriesis as follows:

A "disabled veteran" is one of the following: a veteran of the U.S. military, ground, naval or air service who is entitled to compensation (or who but for the receipt of military retired pay would be entitled to compensation) under laws administered by the Secretary of Veterans Affairs; or a person who was discharged or released from active duty because of a service-connected disability.

A "recently separated veteran" means any veteran during the three- year period beginning on the date of such veteran's discharge or release from active duty in the U.S. military, ground, naval, or air service.

An "active duty wartime or campaign badge veteran" means a veteran who served on active duty in the U.S. military, ground, naval or air service during a war, or in a campaign or expedition for which a campaign badge has been authorized under the laws administered by the Department of Defense.

An "Armed forces service medal veteran" means a veteran who, while serving on active duty in the U.S. military, ground, naval or air service, participated in a United States military operation for which an Armed Forces service medal was awarded pursuant to Executive Order 12985.