Security Engineer

ASM Research, An Accenture Federal Services Company; Columbus (OH); On-site; USD 120,000 - 132,000; Full time

Job summary

ASM Research is seeking a Security Engineer to join a cross‑functional Agile team in Columbus, OH. You will design, implement, and maintain security controls for cloud and data, work on risk mitigation, and document ATO packages with ongoing audits.

The role requires a bachelor’s degree and 4+ years in security operations (federal experience preferred). Familiarity with RMF, ATO/POA&M, Zero Trust, and Okta is expected. Strong collaboration and communication are essential.

Qualifications

• Bachelor's degree and 4+ years in compliance, identity management, networking, systems or cloud security.
• At least 2 years federal work experience on security operations with ATO/change-control/release‑approval.
• Knowledge of NIST 800-53 RMF and A&A/ATO processes including POA&M management.
• Familiarity with FIPS/FISMA and Zero Trust Architecture; Okta exposure; MITRE ATT&CK.
• Hands-on with artifact repositories such as CSAM, Xacta, eMASS, CFACTS.
• Strong communication, documentation, and stakeholder liaison skills.

Responsibilities

• Design, implement, and maintain security solutions, controls, and architecture for cloud, apps, and data.
• Identify and mitigate risks through threat modeling, code reviews, and vulnerability analysis.
• Document audit and security requirements; conduct walkthroughs; perform control self‑assessments.
• Develop and maintain A&A documentation and assemble ATO packages; support third‑party audits.
• Develop POA&Ms; monitor policy compliance; mitigate non‑compliant controls.
• Automate security workflows including API keys, storage, rotation, certs, and access management.
• Evaluate risk with monitoring tools; support scanning and rapid incident response.
• Perform data classification and security assessments; research threats and technologies.
• Mature security/privacy program; coordinate with client CISO and Security Leadership.
• Use Jira to manage tasks and report status to client/executives; collaborate with teams.
• Participate in Agile/SAFe activities; backlog refinement and sprint planning.
• Follow CMS security, accessibility, docs, CM, and SDLC requirements.
• Provide technical guidance and knowledge sharing to the team.

Skills

Security engineering

Threat modeling

Vulnerability analysis

NIST RMF

A&A/ATO processes

Okta

MITRE ATT&CK

Zero Trust Architecture

Jira

Scripting

Penetration testing

Security certifications

Education

Bachelor's degree

Tools

Jira

CSAM

Xacta

eMASS

CFACTS

Job description

The Security Engineer will work as part of a cross-functional Agile team and is expected to:

• Design, implement, and maintain security solutions, controls, and security boundaries/architectures for cloud infrastructure, applications, and sensitive data.

• Identify, assess, and mitigate security risks through threat modeling exercises, application security code reviews, and vulnerability analysis.

• Serve as liaison between development teams and stakeholders to document audit and security requirements, conduct technical and functional walkthroughs, and perform control self‑assessments in support of ATO.

• Create and maintain Assessment and Authorization (A&A) documentation (system security plans, security risk assessments, security test and evaluation plans) and assemble ATO packages for hosted applications; support and lead third‑party audits and security assessments.

• Develop and track Plans of Action and Milestones (POA&Ms), monitor compliance with cybersecurity policy, and mitigate non‑compliant security controls.

• Automate security control workflows, including secure API key generation, storage, rotation, and certificate and access management.

• Evaluate overall risk using monitoring and detection tools (Splunk, New Relic, SIEM, firewall, system, application, native CSP, and vulnerability scanning platforms), and support system scanning and rapid incident response.

• Execute data classification and security assessments for client and program data and research emerging security threats and technologies.

• Continuously mature the security and privacy program and facilitate ATO renewal year over year, working directly with Security Leadership and the client CISO on the functional, technical, and operational controls.

• Use Jira to manage security tasks and remediation status, collaborate with product owners, developers, architects, DevOps engineers, and the COR/GTL on security requirements and risk decisions, and provide client and executive status reporting.

• Participate in Agile and Scaled Agile Framework activities, including backlog refinement, sprint planning, daily stand‑ups, demonstrations, retrospectives, and Program Increment planning.

• Follow CMS security, accessibility, documentation, configuration management, and software development lifecycle requirements.

• Provide technical guidance and security knowledge sharing to other team members as appropriate.

Minimum qualifications include a bachelor's degree and at least four years of relevant experience across compliance, identity management, networking, systems, and cloud security, of which at least two years must be federal work experience supporting security operations on a federal program, including working within formal ATO, change‑control, and release‑approval processes. Candidates must also have working knowledge of the NIST 800-53 Risk Management Framework (RMF) and Assessment and Authorization (A&A)/ATO processes, including POA&M management. The preferred candidate will have familiarity with FIPS and FISMA guidance and Zero Trust Architecture; hands‑on exposure to Okta and frameworks such as MITRE ATT&CK; and knowledge of an artifact repository system (e.g., CSAM, Xacta, eMASS, CFACTS). Strong communication, documentation, and interpersonal skills are important, as the Security Engineer will need to balance security rigor with delivery velocity and production stability while serving as a liaison to stakeholders and client leadership.

Bonus if you have:

• Scripting skills

• Red teaming or penetration testing experience

• Hack‑the‑Box or Capture‑the‑Flag participation

• CISSP, CCSP, CompTIA Security+, Cloud Security certificate (any CSP), CISA, CCNA, or other security/network certifications

Compensation Ranges

Compensation ranges for ASM Research positions vary depending on multiple factors; including but not limited to, location, skill set, level of education, certifications, client requirements, contract‑specific affordability, government clearance and investigation level, and years of experience. The compensation displayed for this role is a general guideline based on these factors and is unique to each role. Monetary compensation is one component of ASM's overall compensation and benefits package for employees.

EEO Requirements

It is the policy of ASM that an individual's race, color, religion, sex, disability, age, sexual orientation or national origin are not and will not be considered in any personnel or management decisions. We affirm our commitment to these fundamental policies.

All recruiting, hiring, training, and promoting for all job classifications is done without regard to race, color, religion, sex, disability, or age. All decisions on employment are made to abide by the principle of equal employment.

Physical Requirements

The physical requirements described in "Knowledge, Skills and Abilities" above are representative of those which must be met by an employee to successfully perform the primary functions of this job. (For example, "light office duties' or "lifting up to 50 pounds" or "some travel" required.) Reasonable accommodations may be made to enable individuals with qualifying disabilities, who are otherwise qualified, to perform the primary functions.

Disclaimer

The preceding job description has been designed to indicate the general nature and level of work performed by employees within this classification. It is not designed to contain or be interpreted as a comprehensive inventory of all duties, responsibilities and qualifications required of employees assigned to this job.

$120,000 - 132,000

EEO Requirements

It is the policy of ASM that an individual's race, color, religion, sex, disability, age, gender identity, veteran status, sexual orientation or national origin are not and will not be considered in any personnel or management decisions. We affirm our commitment to these fundamental policies.

All recruiting, hiring, training, and promoting for all job classifications is done without regard to race, color, religion, sex, veteran status, disability, gender identity, or age. All decisions on employment are made to abide by the principle of equal employment.