Information Systems Security Engineer

Commonwealth of VA Careers; Richmond (VA); Hybrid; USD 110,000 - 140,000; Full time

Benefits offered by this job

12 Paid State holidays

Comprehensive health benefits

Public Service Loan Forgiveness (PSLF)

Job summary

Virginia Tax is seeking an Information Systems Security Engineer to champion security across the Software Development Life Cycle. You will partner with application and engineering teams to identify and mitigate vulnerabilities, develop security plans, and enforce security standards.

The role combines hands-on security work with influencing engineering practices and supporting a security-first culture. The position is based at Main Street Centre in Richmond with a 3/2 hybrid schedule and requires

Qualifications

• Experience providing information security guidance and training.
• Knowledge and experience with application development and security architecture.
• Knowledge of secure coding standards and guidelines and ability to identify security flaws in source code.
• Knowledge of vulnerability remediation and patch management for applications.
• Experience with SAST, DAST, and IAST security testing tools (e.g., Accunetix, Veracode, Jenkins, Splunk, Rapid7, Tenable).
• Knowledge and experience with Web Application Firewalls (WAFs) and AWS Security Groups implementation strategies for application protection.
• Experience with and understanding of security information and event management (SIEM) systems (e.g., Splunk, Azure Sentinel, or IBM QRadar).
• Knowledge and experience with AWS services (e.g., Security Hub, GuardDuty, Security Groups, Inspector, Config, CloudWatch, S3 Buckets, IAM, CloudTrail, EC2, CodePipelines, KMS, and Secrets Manager).
• Knowledge and understanding of relevant security regulations and standards (e.g., NIST 800-53, IRS Pub 1075, PCI-DSS, OWASP Top10, MITRE ATT&CK, CIS Benchmarks, NIST CSF).
• Comprehensive knowledge of a System Security Plan (SSP) and experience in creating and maintaining an SSP.

Responsibilities

• Reviewing system architectures and developing/maintaining system security plans.
• Guiding teams on secure development practices and ensuring adherence to security policies and standards.
• Acting as a security advocate to empower application teams to design, deliver, and operate secure applications and environments.
• Influencing engineering practices to promote a security-first culture across the organization.

Skills

Information security guidance

Application development security

Secure coding standards

Vulnerability remediation

SIEM experience

AWS familiarity

Security policies & standards

Security lifecycle knowledge

Tools

SAST tools

DAST tools

IAST tools

WAFs

AWS Security Groups

Splunk

Azure Sentinel

IBM QRadar

Jenkins

Veracode

Accunetix

Rapid7

Tenable

CodePipeline

KMS

Secrets Manager

Job description

Job Duties

The Virginia Department of Taxation is seeking an Information Systems Security Engineer for the Office of Technology’s Application Security unit to help ensure the protection, confidentiality, integrity, and availability of Virginia Tax information technology resources.
Virginia Tax is undertaking a multiyear effort to modernize its systems and services, including replacing its current tax accounting system. This work will bring new tools and processes to teams across the agency and create opportunities to improve how we serve taxpayers. As these changes take shape, many roles will involve learning new approaches and adapting to evolving ways of working. We welcome candidates with varied experiences and perspectives who are motivated to contribute to this effort and help strengthen service to the Commonwealth.
The Information Systems Security Engineer’s purpose is to champion security throughout the Software Development Life Cycle and serve as a key connection point between application and engineering teams and the broader joint security operations teams. The role focuses on proactively documenting, identifying, assessing, and helping mitigate vulnerabilities before they can be exploited, ensuring applications and environments are built and maintained with strong security controls.
Responsibilities include reviewing system architectures, developing and maintaining system security plans, guiding teams on secure development practices, and ensuring adherence to security policies and standards. As a security advocate and subject matter expert, the Information Systems Security Engineer empowers application teams to design, deliver, and operate secure applications and environments. The position combines hands‑on technical expertise with the ability to influence engineering practices and promote a security‑first culture across the organization.
The position is located at our Main Street Centre location in Richmond Virginia and has a hybrid schedule consisting of 3 days in the office (Tuesday, Wednesday, Thursday) and 2 days teleworking (Monday and Friday).
Candidate must reside within 50 miles of the Richmond office to be eligible for this role.

• Job stability and quality of life! Enjoy your work/life balance with flexible schedule options andup to two days of telework per week.
• 12 Paid State holidayson top of vacation, sick, volunteer, and personal leave!
• Comprehensive and affordable health benefits.
• Got student loans? You may be eligible for the Public Service Loan Forgiveness program.
• Participation in the Virginia Retirement System, VA 457 Deferred Comp, and more.

At Virginia Tax… We are dedicated, resourceful individuals who strive to exceed our customers’ expectations.Not only do we serve the public, we are the public. We are a part of a community that cares about and celebrates each other, who promote opportunities for growth within a stable environment, and support a healthy work-life balance.

Minimum Qualifications

Experience providing information security guidance and training.
Knowledge and experience with application development and security architecture.
Knowledge of secure coding standards and guidelines and ability to identify security flaws in source code.
Knowledge of vulnerability remediation and patch management for applications.
Experience with SAST, DAST, and IAST security testing tools (e.g., Accunetix, Veracode, Jenkins, Splunk, Rapid7, Tenable).
Knowledge and experience with Web Application Firewalls (WAFs) and AWS Security Groups implementation strategies for application protection.
Experience with and understanding of security information and event management (SIEM) systems (e.g., Splunk, Azure Sentinel, or IBM QRadar).
Knowledge and experience with AWS services (e.g., Security Hub, GuardDuty, Security Groups, Inspector, Config, CloudWatch, S3 Buckets, IAM, CloudTrail, EC2 (Elastic Compute Cloud), CodePiplines, KMS, and Secrets Manager.
Knowledge and understanding of relevant security regulations and standards (e.g., NIST 800-53, IRS Pub 1075, PCI- DSS, OWASP Top10, MITRE ATT&CK, CIS Benchmarks, NIST Cybersecurity Framework).
Comprehensive knowledge of a System Security Plan (SSP) and experience in creating and maintaining an SSP.

Additional Considerations

CompTIA Security+, Certified Cloud Security Professional (CCSP), ISC2 CC (Certified in Cybersecurity), CCSP (Certified Cloud Security Professional), AWS Certified Security, AWS Solutions Architect (Associate/Professional), or AWS Security Specialty

Special Instructions

You will be provided a confirmation of receipt when your application and/or résumé is submitted successfully. Please refer to “Your Application” in your account to check the status of your application for this position. All Virginia Tax employees must be current with filing their tax returns ensuring they were filed in compliance with established laws, rules and regulations. Selected candidate(s) will be required to consent to and successfully pass a background investigation which includes fingerprint-based criminal history, tax compliance, and DMV driving record (if applicable) checks. Selected candidates require a valid Driver’s License. The selected candidate will be prohibited from performing tax or accounting services for compensation during or outside business hours. It is the policy of the Commonwealth that all aspects of human resource management be conducted without regard to race (or traits historically associated with race including hair texture, hair type, and protective hairstyles such as braids, locks, and twists); sex; color; national or ethnic origin; religion; sexual orientation; gender identity or expression; age; veteran status; marital status; political affiliation; disability; genetic information; and pregnancy, childbirth, or related medical conditions. Virginia Tax also prohibits retaliation against individuals who raise concerns regarding discrimination, participate in an investigation or complaint process, or otherwise exercise rights protected by law. Virginia Tax is committed to providing equal opportunity to disabled individuals and willing to provide reasonable accommodations to enhance opportunities for individuals with disabilities. Reasonable accommodations are available to applicants with disabilities, if requested, during the application and/or interview process. If accommodations are needed, please contact Human Resources at [phone]. Reasonable accommodations are available to applicants with disabilities, if requested, during the application and/or interview process. If accommodations are needed, please contact Human Resources at [phone]. Virginia Tax participates in E-verify. Consideration for an interview is based solely on the information within the application and/or resume’. In support of the Commonwealth’s commitment to expanding employment opportunities for individuals with disabilities, qualified applicants are encouraged to apply through the Commonwealth’s Alternative Hiring Process (AHP). Applicants seeking consideration through the AHP must obtain an AHP Letter from the Virginia Department for Aging and Rehabilitative Services (DARS) or the Department for the Blind and Vision Impaired (DBVI) and submit the appropriate documentation with their application. Individuals who need an AHP Letter may request one through DARS at https://dars.virginia.gov/employment-services/for-individuals/ahp-letter/. Veterans with disabilities who may qualify for the Alternative Hiring Process are also encouraged to request an AHP Letter and provide the appropriate documentation when applying. You may also call DARS at 804-662-7000, or DBVI at 800-622-2155. If you are Deaf/Hard of Hearing, please use the videophone: 804-325-1316.

Note: Applicants who received a Certificate of Disability from DARS or DBVI dated between April 1, 2022- February 29, 2024, can still use that COD as applicable documentation for the Alternative Hiring Process.

Contact Information

Name: Virginia Tax Talent Acquisition Team

Phone: [phone]

Email: [e-mail]