Security Engineer

Scientific Research Corporation; Orlando (FL); On-site; USD 110,000 - 170,000; Full time

Benefits offered by this job

401(k) match

Health, dental, and vision

Tuition reimbursement

Paid time off

11 holidays

Job summary

Scientific Research Corporation seeks a hands-on Agile-embedded Security Engineer to secure virtualized Modeling & Simulation environments and automate compliance-as-code across a diverse infrastructure.

The role advises security leadership, manages vulnerabilities, and maintains continuous compliance with DoD directives while integrating security into CI/CD within Agile squads. A DoD clearance is required for this position.

Qualifications

• Active DoD 8570/8140 IAT Level II baseline credential required on day one.
• Active DoD Secret clearance with TS/SCI eligibility.
• Bachelor’s degree in Cybersecurity, Computer Science, Information Technology, or a related technical field (equivalent professional experience will be considered).
• Strong understanding of network protocols, security architecture patterns, and hands-on experience securing both Linux-based and Windows-based systems.
• Highly proficient in scripting and programming languages (e.g., Python, PowerShell, Bash).
• Hands-on experience with modern automation and configuration management tools (Ansible, Terraform, Puppet, or Chef).
• Practical understanding of CI/CD concepts, including embedding security controls and compliance-as-code into deployment pipelines.
• In-depth knowledge of modern threat landscapes, software vulnerabilities, threat mitigation techniques, and standard security processes.
• Strong familiarity with cybersecurity frameworks and control sets, specifically NIST SP 800-53, NIST SP 800-171, SOC 2, and/or ISO 27001.
• Proven ability to author clear, concise cybersecurity guidance, SOPs, and program documentation.

Responsibilities

• Implementing, coordinating, and maintaining patching procedures across diverse environments, including Linux, Windows, VMware virtual layers, and Cisco network systems.
• Designing and deploying automated patching processes for Windows and Linux workloads to minimize manual intervention and reduce the overall attack surface.
• Executing and reviewing regular vulnerability scans and DISA STIG compliance audits to assess system risk.
• Analyzing vulnerability data to prioritize and execute remediation efforts across endpoints, networks, and software applications.
• Being responsible for securing and hardening physical and virtual hardware, operating systems, and software configurations.
• Supporting the tracking, resolution, and milestone completion for POA&M items.
• Authoring, updating, and maintaining comprehensive program security policies, operational procedures, and technical security standards.
• Ensuring all engineering and operational activities comply with relevant DoD standards, directives, regulations, and NIST frameworks.
• Conducting structured risk assessments and providing direct technical support for program audit activities.
• Serving as a key technical advisor to the ISSO and ISSM on security, engineering, and monitoring of classified DoD networks.
• Creating, updating, and maintaining detailed data flow and system boundary diagrams to support authorization packages.
• Remaining continuously abreast of emerging technologies, cyber threats, vulnerabilities, and modern security tools.

Skills

Python

PowerShell

Bash

CI/CD concepts

NIST 800-53/800-171

DoD 8570/8140 IAT Level II

Vulnerability management

Threat modeling

Security tooling

Education

Bachelor's degree in Cybersecurity, Computer Science, Information Technology, or related field

Tools

Ansible

Terraform

Puppet

Chef

Splunk

Trellix

Wazuh

Docker

Kubernetes

VMware

Cisco networking

Job description

Description

SRC is hiring a hands-on, Agile-embedded Security Engineer responsible for securing virtualized Modeling & Simulation (M&S) environments, automating compliance-as-code across a diverse infrastructure, and developing custom security tools and telemetry dashboards. This role bridges the gap between technical execution and security governance by advising security leadership, managing vulnerabilities, and ensuring continuous compliance with DoD directives.

Vulnerability & Patch Management

• Implementing, coordinating, and maintaining patching procedures across diverse environments, including Linux, Windows, VMware virtual layers, and Cisco network systems
• Designing and deploying automated patching processes for Windows and Linux workloads to minimize manual intervention and reduce the overall attack surface
• Executing and reviewing regular vulnerability scans and DISA STIG compliance audits to assess system risk
• Analyzing vulnerability data to prioritize and execute remediation efforts across endpoints, networks, and software applications
• Being responsible for securing and hardening physical and virtual hardware, operating systems, and software configurations

Governance, Risk & Compliance (GRC)

• Supporting the tracking, resolution, and milestone completion for the program’s Plan of Action and Milestones (POA&M) items
• Authoring, updating, and maintaining comprehensive program security policies, operational procedures, and technical security standards
• Ensuring all engineering and operational activities comply with relevant DoD standards, directives, regulations, and NIST frameworks
• Conducting structured risk assessments and providing direct technical support for program audit activities
• Serving as a key technical advisor to the ISSO (Information System Security Officer) and ISSM (Information System Security Manager) on the security, engineering, and monitoring of classified DoD networks
• Creating, updating, and maintaining detailed data flow and system boundary diagrams to support authorization packages
• Remaining continuously abreast of emerging technologies, cyber threats, vulnerabilities, and modern security tools

Security Architecture & Engineering

• Designing, implementing, configuring, and managing comprehensive security solutions, including SIEM (Splunk), EDR (Trellix), Host/Network IDS/IPS (Wazuh), firewalls, Identity & Access Management (IAM), and VPNs
• Evaluating, testing, and integrating new security technologies, tools, and SaaS/on-prem solutions into the existing environment
• Embedding directly within Agile software development squads, collaborating during sprint planning, story estimation, and retrospectives to ensure security engineering tasks keep pace with release cadence

#LI-DH1

Requirements

• Active DoD 8570/8140 IAT Level II baseline credential (such as CompTIA Security+ CE, CySA+, or equivalent) required on day one
• Active DoD Secret clearance with verified TS/SCI Eligibility (ability to pass a Single Scope Background Investigation)
• Bachelor’s (BS) degree in Cybersecurity, Computer Science, Information Technology, or a related technical field (equivalent professional experience will be considered)
• Strong understanding of network protocols, security architecture patterns, and hands‑on experience securing both Linux-based and Windows-based systems
• Highly proficient in scripting and programming languages (e.g., Python, PowerShell, Bash) to build custom automated tools and utilities
• Hands‑on experience with modern automation and configuration management tools (such as Ansible, Terraform, Puppet, or Chef)
• Practical understanding of CI/CD concepts, including how to embed security controls, automated testing, and compliance‑as‑code into deployment pipelines
• In‑depth knowledge of modern threat landscapes, software vulnerabilities, threat mitigation techniques, and standard security processes
• Strong familiarity with cybersecurity frameworks and control sets, specifically NIST SP 800-53, NIST SP 800-171, SOC 2, and/or ISO 27001
• Proven ability to author clear, concise, and accurate cybersecurity guidance, standard operating procedures (SOPs), and program documentation

Desired Skills

• Prior experience supporting cybersecurity operations for high‑fidelity DoD modeling, simulation, and synthetic training networks
• Experience conducting threat modeling, static code analysis (SAST), or dynamic code analysis (DAST) within software development lifecycles
• Familiarity with securing containerized environments (Docker) and container orchestration platforms (Kubernetes)

Clearance Information

SRC IS A CONTRACTOR FOR THE U.S. GOVERNMENT, THIS POSITION WILL REQUIRE U.S. CITIZENSHIP AS WELL AS, A U.S. GOVERNMENT SECURITY CLEARANCE AT THE SECRET LEVEL WITH TOP SECRET / SCI ELGILIBILTY

Travel Requirements

• Minimal (<10%)

About Us

Scientific Research Corporation is an advanced information technology and engineering company that provides innovative products and services to government and private industry, as well as independent institutions. At the core of our capabilities is a seasoned team of highly skilled engineers and scientists with multidisciplinary backgrounds. This team is challenged daily to provide cutting edge technology solutions to our clients.

SRC offers a generous benefit package, including medical, dental, and vision plans, 401(k) with a company match, life insurance, vacation and sick paid time off accruals with amounts increasing based on role and years of service, 11 paid holidays, tuition reimbursement, and a work environment that encourages excellence and more. For positions requiring a security clearance, selected applicants will be subject to a government security investigation and must meet eligibility requirements for access to classified information.

EEO

Scientific Research Corporation is an equal opportunity employer that does not discriminate in employment. All qualified applicants will receive consideration for employment without regard to their race, color, religion, sex, age, sexual orientation, gender identity, national origin, disability, protected veteran status, or any other protected characteristic under federal, state or local law.

Scientific Research Corporation endeavors to make www.scires.com accessible to any and all users. If you would like to contact us regarding the accessibility of our website or need assistance completing the application process, please contact [e-mail] for assistance. This contact information is for accommodation requests only and cannot be used to inquire about the status of applications.