Information Systems Security Engineer

Csengineering; Rockville (MD); Remote; USD 120,000 - 160,000; Full time

Job summary

CSEngineering is seeking an experienced Information System Security Engineer to support IHS in RMF, SSP development, and compliance activities. This remote role involves managing POA&Ms, logging, and security assessments while liaising with System Owners and cybersecurity teams.

The ideal candidate will have hands-on RMF/A&A experience, RSA Archer expertise, CISSP/CISM, and US citizenship, with remote-friendly flexibility and up to 10% travel as needed.

Qualifications

• Bachelor's degree in Computer Science, IT, Cybersecurity, or related field.
• 8+ years of dedicated cybersecurity experience.
• 5+ years of hands-on RMF and A&A using NIST SP 800-53 Rev.4/Rev. 5.
• 2+ years using RSA Archer to manage security controls and POA&Ms.
• Experience managing multiple SSPs concurrently.
• CISSP or CISM certification.
• U.S. Citizenship required.

Responsibilities

• Develop, validate, update, and maintain SSPs per NIST SP 800-53 Rev. 5.
• Review and validate SSP documentation across systems.
• Serve as Information Security SME and guide System Owners on RMF.
• Review POA&Ms, identify gaps, and advise remediation.
• Manage security controls, POA&Ms, and evidence in RSA Archer.
• Support system assessments, risk assessments, audits, and remediation.
• Evaluate architectures to identify vulnerabilities and propose improvements.
• Assist System Owners with Categorization Worksheets and controls.
• Provide risk-based assessments to ISSO Lead and Federal HQ ISSO.
• Review vulnerability reports and coordinate remediation with owners and IR teams.
• Configure and manage Splunk M-21-31 logging packages and Splunk SIEM levels.
• Generate logging reports to support M-21-31 and EO 14028.
• Liaise with security teams and stakeholders on objectives and requirements.
• Provide documentation and reporting to support compliance and risk initiatives.

Skills

RMF/A&A

ISSO guidance

Security controls

Vulnerability remediation

Documentation & reporting

Stakeholder communication

Education

Bachelor's degree in Computer Science, Information Technology, Cybersecurity, Information Assurance, or related field

Tools

RSA Archer

Splunk Enterprise

Splunk ES

Splunk UBA

Job description

Information System Security Engineer

**Immediate Requirement**

**Remote work**

CSEngineering is seeking an experienced Information System Security Engineer to join our growing team! This position will support the Indian Health Service (IHS), Division of Information Security, under the M-21-31 Logging, Reporting and SSP Development Services effort.

The ideal candidate will bring strong expertise in Information System Security Officer (ISSO) support, Risk Management Framework (RMF), System Security Plan (SSP) development, and cybersecurity compliance. This role will focus on supporting NIST SP 800-53 Rev. 5 security controls, managing compliance documentation through RSA Archer, conducting security assessments, reviewing Plans of Action and Milestones (POA&Ms), and supporting Splunk-based logging and reporting operations.

This is a fully remote position with occasional travel (up to 10%) as required.

JOB RESPONSIBILITIES

• Develop, validate, update, and maintain System Security Plans (SSPs) in accordance with NIST SP 800-53 Rev. 5 requirements.
• Review and validate SSP documentation across assigned systems and maintain accurate compliance records.
• Serve as an Information Security Subject Matter Expert (SME) and provide guidance to System Owners on security control implementation and RMF requirements.
• Review POA&Ms, identify security control gaps, and recommend corrective actions and remediation strategies.
• Manage and update security controls, POA&Ms, supporting evidence, and compliance documentation within RSA Archer.
• Support system assessments, security risk assessments, internal and third-party audits, and vulnerability remediation activities.
• Evaluate system architectures and technology solutions to identify security vulnerabilities and recommend improvements.
• Assist System Owners with System Categorization Worksheets and security control implementation.
• Provide risk-based assessments and recommendations to the ISSO Lead and Federal HQ ISSO.
• Review vulnerability reports and coordinate with System Owners and Cybersecurity Incident Response teams on remediation activities.
• Configure, maintain, and manage Splunk M-21-31 logging packages and Splunk SIEM across EL1, EL2, and EL3 logging levels.
• Generate and maintain logging reports in support of OMB Memorandum M-21-31 and Executive Order 14028.
• Serve as a liaison between information security teams, System Owners, and other stakeholders to communicate security objectives and requirements.
• Provide technical recommendations, documentation, and reporting to support enterprise cybersecurity compliance and risk management initiatives.

REQUIRED QUALIFICATIONS

• Bachelor's degree in Computer Science, Information Technology, Cybersecurity, Information Assurance, or a related engineering discipline.
• Minimum of 8 years of dedicated cybersecurity or information assurance experience.
• At least 5 years of hands-on experience with the NIST Risk Management Framework (RMF) and Assessment and Authorization (A&A) processes using NIST SP 800-53 Rev. 4/Rev. 5.

• Minimum of 2 years of hands-on experience using RSA Archer to manage security controls, POA&Ms, and compliance documentation.

• Demonstrated experience managing multiple System Security Plans (SSPs) concurrently, preferably across a large portfolio of systems.
• Strong experience advising non-technical System Owners on cybersecurity requirements, risk management, and security control implementation.
• Proficiency in Splunk, Splunk Enterprise, Splunk Security Enterprise, and Splunk User Behavior Analytics (UBA).
• CISSP or CISM certification required.
• Citizenship: Must be a U.S. Citizen.

Location: Remote (Candidate must be in the DC area)

PREFERRED CERTIFICATIONS

• Information Systems Security Engineering Professional (ISSEP).
• Certified in Risk and Information Systems Control (CRISC).
• CompTIA CASP+.
• At least 5 years of experience with Splunk Enterprise, Splunk Enterprise Security, and User Behavior Analytics (UBA).

ADDITIONAL REQUIREMENTS

• Experience supporting federal government cybersecurity programs is beneficial.
• Strong analytical, documentation, communication, and stakeholder management skills.
• Ability to manage multiple security compliance requirements and meet task-specific response timelines.

BACKGROUND AND SECURITY SCREENING

• Final candidates may be subject to employment verification, education verification, professional reference checks, criminal background screening, security clearance verification, and/or suitability review, as permitted by applicable federal, state, and local laws.
• Candidates are expected to provide accurate and complete information throughout the application and interview process. Any material misrepresentation, omission of relevant information, falsification of qualifications, certifications, employment history, clearance status, or educational credentials may result in removal from consideration or withdrawal of an employment offer.
• For positions supporting federal agencies or government contracts, additional security, clearance, credentialing, or customer-specific suitability requirements may apply.

COMPANY OVERVIEW

Who we are- CSEngineering, a Service-Disabled Veteran-owned small business established in 2002, is dedicated to becoming the premier engineering and services firm in our industry, all while prioritizing client satisfaction above all else.

What we do- With a rich history of excellence, we boast significant expertise in a wide array of areas, including satellite systems, weapons and missile systems, naval architecture, aviation systems, IT and Enterprise Architecture, and more. We offer a comprehensive range of services, including logistics, program management, and IT operations. As a recipient of the Hire Vets Gold Medallion award, we're proud of our commitment to veteran hiring, retention, and professional development.

Why should you be a part of CSE- At CSEngineering, our employees are at the heart of everything we do. We foster a culture of passion and growth, where individuals are encouraged to excel build fulfilling careers, and continually strive for excellence. Our dedication to innovation and excellence propels us forward, as we continuously strive to set new standards in our industry. Join us and be part of a team that's redefining what's possible.

CSEngineering offers a competitive salary and comprehensive benefits package, including medical, dental, life, disability, 401k, and paid time off.

CSEngineering is an equal opportunity employer committed to a culturally diverse workforce. All qualified applicants will receive consideration for employment without regard to race, religion, color, age, sex, national origin, sexual orientation, gender identity, or veteran status.