Senior Cybersecurity Integration Engineer

BaseCamp Consulting & Solutions; Reston (VA); On-site; USD 120,000 - 180,000; Full time

Job summary

BaseCamp Consulting & Solutions seeks a Senior Cybersecurity Integration Engineer to secure and integrate the enterprise API gateway, drive it through the RMF toward a signed Authority to Operate (ATO), and sustain it with continuous monitoring.

The role combines hands-on security engineering at the API boundary with ownership of the System Security Plan, control narratives, and evidence for RMF; requires an active MBI and US citizenship.

Qualifications

• Eight years of hands-on cybersecurity or integration engineering on enterprise API gateway, IAM, or boundary security platforms in production.
• Experience leading System Security Plans and RMF workflows for Federal systems.
• Strong understanding of API security protocols and federation services.

Responsibilities

• Design and enforce API security policy across authentication, authorization, and token validation.
• Coordinate RMF activities to achieve and sustain ATO for the gateway.
• Author and maintain the SSP and control narratives per NIST 800-53 Rev 5 and related guidance.
• Perform continuous monitoring and vulnerability response across gateway, network, and identity layers.
• Onboard applications and services, coordinating changes with owning teams.

Skills

API gateway security

RMF / ATO

NIST 800-53

FISMA experience

OAuth 2.0 / OpenID Connect

TLS / mTLS

SIEM (Splunk)

System Security Plan

Vulnerability management

Fed compliance

Education

Bachelor's degree in Engineering/CS/C cybersecurity

Tools

eMASS / Xacta / CSAM

CA SiteMinder / Ping Federate

Job description

POSITION OVERVIEW

The Senior Cybersecurity Integration Engineer secures and integrates the Customer's enterprise API gateway, drives it through the Risk Management Framework to a signed Authority to Operate (ATO), and keeps it authorized. The role pairs hands-on security engineering at the API boundary with ownership of the System Security Plan and the continuous monitoring that sustains it. Requires an active Moderate Background Investigation (MBI) at start.

RESPONSIBILITIES

• Design and enforce API security policy — authentication, authorization, token validation, rate limiting, payload validation, threat protection
• Manage TLS, mutual TLS, and certificate and key lifecycle across all environments and trust relationships
• Onboard applications, vendors, and SaaS services, coordinating firewall, proxy, DNS, and load balancer changes with owning teams
• Integrate the gateway with enterprise identity and federation services
• Harden gateway and hosts to STIG/SCAP and feed security telemetry to the enterprise SIEM
• Promote configuration through the Customer's environments under Government change control
• Author and maintain the SSP and control narratives against NIST 800‑53 Rev 5, covering boundary, inventory, inheritance, and tailoring
• Run the RMF package to ATO: evidence, assessor walkthroughs, finding resolution
• Sustain ConMon: recurring scans, false positive validation, remediation and retest, POA&M closure, deviation requests, monthly reporting
• Perform security impact analysis on changes and troubleshoot across gateway, network, identity, and application layers

REQUIRED QUALIFICATIONS

• Active MBI, current and transferable as of your start date
• U.S. citizenship, as required for Customer contractor staff
• Eight years of hands‑on cybersecurity or integration engineering on enterprise API gateway, IAM, or boundary security platforms in production, including three years in a Federal FISMA environment
• Production ownership of an enterprise API gateway or comparable platform: policy authoring, upgrades, certificate lifecycle, environment promotion, and production support
• Depth in API and web security protocols: OAuth 2.0, OpenID Connect, JWT validation, SAML 2.0 federation, mutual TLS, PKI, and the OWASP API Security Top 10
• Experience integrating services across network and security boundaries, coordinating changes with separate firewall, proxy, and identity teams
• Authorship of a System Security Plan for a Federal system, writing control narratives from actual configuration and documenting inherited, hybrid, and tailored controls
• Experience carrying a system or major component through RMF to a signed ATO, then sustaining it under continuous monitoring
• Command of FISMA and NIST 800‑37, 800‑53 Rev 5, 800‑53A, and 800‑137
• End‑to‑end vulnerability management: scanning, validating false positives, remediating, retesting, and documenting closure
• Linux administration on RHEL or CentOS, shell scripting, and SIEM log integration such as Splunk
• Technical writing strong enough that control narratives hold up under assessor review
• Bachelor's degree in Engineering, Computer Science, Cybersecurity, or Information Systems, or equivalent hands‑on experience

PREFERRED QUALIFICATIONS

• An active professional security certification such as CISSP, CISA, CISM, CAP or CGRC, GIAC, or Security+
• Time as an ISSO or ISSM, or directly supporting one, on a FISMA-reportable system
• Hands‑on authoring inside a GRC or RMF tool of record such as eMASS, Xacta, or CSAM
• An active vendor certification on the program's gateway platform, or willingness to earn it within 90 days; training provided
• Prior support to a Federal financial or tax administration program
• Experience with configuration‑as‑code, separated control and data planes, and API‑driven gateway administration
• Depth in a federation platform such as Ping Federate, Ping Access, or CA SiteMinder