Information Systems Security Engineer

Cybersecurity Jobs; Richmond (VA); Hybrid; USD 95,000 - 120,000; Full time

Benefits offered by this job

Job stability

Flexible schedule

Hybrid work

Health benefits

PSLF program

Job summary

Virginia Tax in Richmond, VA is hiring for a hybrid security role focused on protecting applications across the Software Development Life Cycle. The job offers flexibility with up to two days of telework and a schedule of three days in the office.

You will guide engineering teams on secure development, review architectures, and manage vulnerability remediation using SAST/DAST/IAST tools, WAFs, and AWS security services, while complying with NIST and PCI-DSS standards.

Qualifications

• Experience providing information security guidance and training.
• Knowledge of application development and security architecture.
• Knowledge of secure coding standards and guidelines and ability to identify security flaws in source code.
• Knowledge of vulnerability remediation and patch management for applications.

Responsibilities

• Protect confidentiality, integrity, and availability of Virginia Tax information technology resources.
• Champion security across the Software Development Life Cycle for application security.
• Act as a connection point between application and engineering teams and the broader joint security operations teams.
• Proactively document, identify, assess, and help mitigate vulnerabilities before they can be exploited, ensuring applications and environments are built and maintained with strong security controls.
• Review system architectures.
• Develop and maintain system security plans.
• Guide teams on secure development practices and support a security-first culture through influence on engineering practices.
• Ensure adherence to security policies and standards and empower application teams to design, deliver, and operate secure applications and environments.

Skills

Application development

Security architecture

Vulnerability remediation

SAST/DAST/IAST

Web Application Firewalls

AWS Security Groups

SIEM

NIST 800-53

IRS Pub 1075

PCI-DSS

MITRE ATT&CK

Tools

Accunetix

Veracode

Jenkins

Splunk

Rapid7

Tenable

Job description

Hybrid role in Richmond, VA with a focus on securing applications across the Software Development Life Cycle. The Virginia Department of Taxation offers job stability and quality of life, including flexible schedule options and up to two days of telework per week.

Salary: USD 95,000 - 120,000 per year.

Location: Richmond, VA (hybrid). The position is based at the Main Street Centre location with 3 days in the office (Tuesday, Wednesday, Thursday) and 2 days teleworking (Monday and Friday). To be eligible, candidates must reside within 50 miles of the Richmond office.

What you’ll do

• Help protect the confidentiality, integrity, and availability of Virginia Tax information technology resources.
• Champion security across the Software Development Life Cycle for application security.
• Act as a connection point between application and engineering teams and the broader joint security operations teams.
• Proactively document, identify, assess, and help mitigate vulnerabilities before they can be exploited, ensuring applications and environments are built and maintained with strong security controls.
• Review system architectures.
• Develop and maintain system security plans.
• Guide teams on secure development practices and support a security-first culture through influence on engineering practices.
• Ensure adherence to security policies and standards and empower application teams to design, deliver, and operate secure applications and environments.

Skills and requirements

• Experience providing information security guidance and training.
• Knowledge and experience with application development and security architecture.
• Knowledge of secure coding standards and guidelines and ability to identify security flaws in source code.
• Knowledge of vulnerability remediation and patch management for applications.
• Experience with SAST, DAST, and IAST tools (for example: Accunetix, Veracode, Jenkins, Splunk, Rapid7, Tenable).
• Knowledge and experience with Web Application Firewalls (WAFs) and AWS Security Groups implementation strategies for application protection.
• Experience with SIEM systems (for example: Splunk, Azure Sentinel, or IBM QRadar).
• Knowledge and experience with AWS services, including Security Hub, GuardDuty, Security Groups, Inspector, Config, CloudWatch, S3 Buckets, IAM, CloudTrail, EC2, CodePipelines, KMS, and Secrets Manager.
• Knowledge of relevant security regulations and standards, including NIST 800-53, IRS Pub 1075, PCI-DSS, OWASP Top10, MITRE ATT&CK, CIS Benchmarks, and the NIST Cybersecurity Framework.
• Comprehensive knowledge of a System Security Plan (SSP), including creating and maintaining an SSP.

Tools and technologies

Accunetix, Veracode, Jenkins, Splunk, Rapid7, Tenable, Web Application Firewalls (WAFs), AWS Security Groups, SIEM, Azure Sentinel, IBM QRadar, Security Hub, GuardDuty, Inspector, Config, CloudWatch, S3 Buckets, IAM, CloudTrail, EC2 (Elastic Compute Cloud), CodePiplines, KMS, Secrets Manager, NIST 800-53, IRS Pub 1075, PCI-DSS, OWASP Top10, MITRE ATT&CK, CIS Benchmarks, NIST Cybersecurity Framework.

Benefits

• Job stability and quality of life: flexible schedule options and up to two days of telework per week.
• 12 Paid State holidays on top of vacation, sick, volunteer, and personal leave.
• Comprehensive and affordable health benefits.
• Public Service Loan Forgiveness may be available for eligible applicants.
• Participation in the Virginia Retirement System, VA 457 Deferred Comp, and more.

Additional considerations

• CompTIA Security+
• Certified Cloud Security Professional (CCSP)
• ISC2 CC (Certified in Cybersecurity)
• AWS Certified Security
• AWS Solutions Architect (Associate/Professional)
• AWS Security Specialty

Important application and eligibility notes

• After submitting, you will receive confirmation of receipt. Check status in your account under “Your Application”.
• All Virginia Tax employees must be current with filing their tax returns in compliance with established laws, rules, and regulations.
• Selected candidates must consent to and successfully pass a background investigation including fingerprint-based criminal history, tax compliance, and DMV driving record checks (if applicable).
• A valid Driver’s License is required.
• The selected candidate will be prohibited from performing tax or accounting services for compensation during or outside business hours.

Contact: Virginia Tax Talent Acquisition Team
Phone: [phone]
Email: [e-mail]