Sr Systems Security Engineer

snc; Lone Tree (CO); On-site; USD 140,000 - 190,000; Full time

Job summary

SNC is seeking a Senior Systems Security Engineer to lead the design, implementation, and governance of our security architecture within a defense program. You will manage complex security projects, mentor junior engineers, and coordinate RMF/ATO activities with government stakeholders.

The role combines hands-on vulnerability management and SIEM operations with governance duties, including policy development and compliance reporting.

Qualifications

• 8+ years of IT security experience in defense or related field.
• Formal ISSM role with direct ATO package ownership.
• Experience briefing government stakeholders at security reviews or AO-level meetings.
• Deep knowledge of NIST 800-53 Rev 5, RMF/ATO lifecycle, and control tailoring.

Responsibilities

• Lead end-to-end cybersecurity posture for information systems in a defense program.
• Oversee vulnerability management, SIEM operations, STIG hardening, and monitoring.
• Own RMF/ATO strategy and security policy enforcement across the program.
• Brief program security status to government stakeholders and AO-level officials.
• Mentor ISSOs/ISSEs and coordinate with DCSA/IC/government representatives.

Skills

Security architecture

RMF/ATO lifecycle

NIST 800-53 Rev 5

STIG hardening

Splunk SIEM

Tenable dashboards

Governance leadership

AO interface experience

Education

Bachelor's degree in Systems Security, Network Engineering, Information Technology, or related Engineering discipline

Tools

Splunk SIEM

Tenable dashboards

DISA STIG tooling

Job description

If you like solving complex IT and security problems using your deep analytical skills, this is the opportunity for you! As a Senior Systems Security Engineer, you will lead the design and implementation of our security infrastructure. You will manage complex security projects, provide strategic direction for security practices, and mentor junior engineers.

The ISR (Intelligence, Surveillance & Reconnaissance), Aviation, and Security (IAS) business area is a leader in ISR and aviation, it is a leading prime manned and unmanned aircraft systems integrator for innovative, high-performance ISR and aviation systems. Its end-to-end Command, Control, Computers, Communications and Intelligence, Surveillance & Reconnaissance (C4ISR) capabilities encompass design, integration, test, certification, ground/flight training and complete logistics support. IAS tailors solutions to customer cost, performance, and schedule requirements and designs to consistently exceed expectations - with an unrivaled record of on time and on (or under) budget deliveries.

Responsibilities:

The Senior Systems Security Engineer / Information System Security Manager (ISSM) is a dual-mode technical SME and program security lead responsible for the end-to-end cybersecurity posture, compliance governance, and system accreditation of information systems within a complex defense program environment.

This role combines active hands-on-keyboard technical security execution - vulnerability scanning, SIEM operations, STIG hardening, and system monitoring - with senior leadership accountability for ISSO team development, ATO lifecycle management, DCSA/DoW/IC compliance framework implementation, and direct representation of program security posture to government stakeholders and Authorizing Officials.

The Senior Systems Security Engineer / ISSM operates with authority across both the technical and governance dimensions of information security.

On the technical side, they execute and oversee vulnerability management, security monitoring, configuration hardening, and incident response with hands-on proficiency.

On the governance and leadership side, they own the program's RMF/ATO strategy, develop and enforce the security policies and procedures that govern the program environment, train and mentor ISSOs/ISSEs, coordinate with DCSA/DOW/IC and government stakeholders, and brief program security status at formal USG reviews.

Neither dimension is optional - this role demands both simultaneously.

Qualifications You Must Have:

• Bachelor's degree in Systems Security, Network Engineering, Information Technology, or related Engineering discipline.
• 8+ years of experience in IT security or a related field.
• Relevant experience can be considered as a substitute for the required educational qualifications. In the absence of a degree, a minimum of 16 years of related experience is required.
• Higher level relevant degree may substitute for experience.
• A minimum of 8 years in a formal ISSM role with direct ATO package ownership and government AO interface responsibility.
• Deep expertise in cybersecurity principles and practices.
• Experience with security frameworks and standards such as National Institute of Standards and Technology (NIST), ISO 27001.
• Demonstrated experience to describe configuring scan policies, executing credentialed scans, interpreting results, and building Tenable dashboards from personal execution, not oversight.
• Demonstrated hands-on Splunk SIEM experience - developing correlation searches, dashboards, and security use cases; triaging SIEM alerts; and managing Splunk forwarder deployments.
• Active DISA STIG application experience - must have personally applied STIGs to live systems, not just reviewed or documented STIG compliance. Ability to describe specific STIG finding categories, compensating control documentation, and POA&M management.
• Demonstrated experience presenting security posture to government stakeholders - has personally briefed at government security reviews, ARBs, or AO-level meetings. Not supported a presenter - led the brief.
• Deep working knowledge of NIST 800-53 Rev 5 - can explain control families, tailoring rationale, control inheritance, and assessment procedures without reference material.
• Demonstrated RMF/ATO lifecycle ownership - has personally developed SSPs, SARs, POA&Ms, and security assessment evidence packages and presented them to a government AO for authorization decision.
• Working knowledge of DCSA DAAG requirements for classified IS accreditation - has operated within a DCSA-governed program environment and coordinated with DCSA field representatives.
• Working knowledge of CMMC framework - understands Level 2/3 practice domains, assessment objectives, and CUI protection requirements.
• Has authored or substantially contributed to PPSM documentation - understands port/protocol justification requirements, DoD PPSM registry process, and PPSM enforcement mechanisms.
• Demonstrate hands on proficiency on