Linux System Security Engineer

The Midtown Group; Leesburg (VA); On-site; USD 190,000 - 205,000; Full time

Benefits offered by this job

100% medical insurance premiums

6% 401(k) match with immediate vesting

3 weeks paid vacation

11 paid federal holidays

Educational assistance up to $7,000/yr

Job summary

The Midtown Group is seeking a mid-to-senior Linux System Security Engineer to design, harden, and defend our on-premises Linux and macOS infrastructure in Leesburg, VA. This on-site role offers high autonomy and direct ownership over security tooling, automation, and incident response.

You will implement security controls, automate tasks with Ansible and Python, and collaborate with the Security Lead and Compliance Manager to balance security with rapid development. U.S.

Qualifications

• B.S. in Computer Science, Computer Engineering, or a related technical field.
• 10+ years of hands-on experience as a Security Engineer or similar.
• On-premises Linux and Apple/macOS expertise.
• Open-source tooling: Git, Wazuh, Elasticsearch/OpenSearch.
• Configuration management with Ansible; Python and Shell scripting.
• Strong networking fundamentals: TCP/IP, DNS, DHCP, VPN.
• U.S. citizenship and ability to obtain security clearance; on-site Leesburg, VA.

Responsibilities

• Own On-Premises Security: design, implement, and maintain security practices across internal infrastructure (Linux and macOS).
• Harden Systems: Linux hardening, kernel tuning, service management, secure config.
• Automate Everything: automate security tasks with Ansible, Python, Shell scripts.
• Monitor & Mitigate Threats: audit for vulnerabilities, apply patches, manage logging stacks (Wazuh, Elasticsearch/OpenSearch).
• Collaborate Across Engineering: align security strategies with Security Lead, Compliance Manager, and engineers.

Skills

Linux security

macOS security

Ansible

Python

Shell scripting

Git

Wazuh

Elasticsearch/OpenSearch

Networking basics

Security engineering

Education

B.S. in Computer Science/Computer Engineering or related field

Tools

Ansible

Python

Shell

Wazuh

Elasticsearch/OpenSearch

Git

Job description

Job Title: Mid-to-Senior Linux System Security Engineer (On-Site)

Location: Leesburg, VA (5 Days On-Site with Flexible Commute Hours)

Compensation: $190,000 – $205,000 Base Salary (Flexible based on experience) + 100% Paid Employee Medical + 6% Immediate 401(k) Match

Clearance Requirement: U.S. Citizenship required; must be able to obtain and maintain a U.S. Government security clearance.

We are looking for a Mid-to-Senior Linux System Security Engineer to serve as the right-hand technical partner to our Security Lead. Because of the sensitive nature of our mission, we rely heavily on on-premises infrastructure rather than public cloud environments. You will have high visibility, massive autonomy, and direct ownership over designing, hardening, automating, and defending our internal Linux and macOS infrastructure from the ground up.

Why You’ll Love Working Here Long-Term

• Top-Tier Compensation: $190,000 – $205,000 base salary, with flexibility based on your demonstrated skills and experience.
• Unbeatable Healthcare Coverage: We pay 100% of your medical insurance premiums (and 75% for your dependents) through Anthem medical and Guardian dental, alongside full life and disability coverage.
• Immediate Retirement Wealth Building: 6% 401(k) company match with immediate vesting from day one.
• Generous Time Off & Growth: 3 weeks of paid vacation, 2 weeks of paid sick leave, 11 paid federal holidays, and up to $7,000 per year in educational assistance.
• Common-Sense Commute Flexibility: While the nature of our on-premises infrastructure requires this role to be in our Leesburg, VA office 5 days a week, we don't believe in rigid clock-watching. Our leadership understands Northern Virginia traffic and supports flexible early-in / early-out schedules so you can beat the rush hour.

What You Will Be Doing

• Own On-Premises Security: Design, implement, and maintain security practices across our internal infrastructure, with a heavy emphasis on physical, on-premises Linux servers and Apple/macOS endpoints.
• Harden Systems: Perform deep Linux system hardening, including kernel tuning, service management, and secure infrastructure configuration.
• Automate Everything: Eliminate manual busywork by automating security tasks, configurations, and deployments using Ansible (writing and maintaining playbooks and roles) alongside Python and Shell scripting.
• Monitor & Mitigate Threats: Regularly audit systems for vulnerabilities, apply security patches, and manage open-source security monitoring and logging stacks (Wazuh, Elasticsearch/OpenSearch, Git).
• Collaborate Across Engineering: Partner directly with our Security Lead, Compliance Manager, and fellow engineers to align security strategies without slowing down innovation.

What You Need to Succeed (Required)

• Experience & Education: B.S. in Computer Science, Computer Engineering, or a related technical field, plus 10+ years of hands‑on experience as a Security Engineer, Linux Systems Administrator, or similar role.
• On-Premises Linux & macOS Expertise: Deep, hands‑on proficiency securing on‑premises Linux environments and Apple/macOS systems (candidates whose experience is exclusively cloud‑based or Windows‑only will not be a fit for our environment).
• Open‑Source Security Tooling: Proven experience working with Git, Wazuh, and Elasticsearch or OpenSearch.
• Configuration Management & Scripting: Strong hands‑on experience writing and maintaining Ansible playbooks/roles, plus proficiency in Python and Shell/Bash scripting to build security tools and automate monitoring.
• Network Security Fundamentals: Solid command of networking protocols (TCP/IP, DNS, DHCP, VPN) and network defense, including firewalls, VPNs, and network segmentation.
• Location & Clearance: Must be a U.S. Citizen able to obtain and maintain a U.S. Government security clearance, and able to work on‑site 5 days a week in Leesburg, VA.

Bonus Points (Preferred)

• Familiarity with DNS infrastructure and tools (BIND, Unbound, and/or PowerDNS).
• Experience with Fluent Bit or Fluentd for log collection, processing, and forwarding across distributed environments.
• Hands‑on experience with virtualization platforms (VMware, Proxmox, VirtualBox).