Cybersecurity Engineer

This is a fully remote position, open to applicants in United States.

📋 Description

• Take ownership of the compliance posture in the unclassified environment and maintain the System Security Plan in alignment with NIST SP 800-171 and CMMC Level 2.

• Track findings and vulnerabilities while managing Plans of Action and Milestones (POA&Ms) to facilitate remediation efforts.

• Generate and sustain SPRS scores, identifying gaps prior to third-party assessments.

• Follow Change Management processes and collaborate with the Change Control Board to validate and test infrastructure modifications before they are deployed into production.

• Plan and execute thorough self-assessments, serving as an internal auditor.

• Lead the preparation for C3PAO assessments, compiling evidence, interviewing technical personnel, and ensuring audit readiness.

• Document controls for external auditors and translate technical requirements for non-technical leadership.

• Secure and monitor Google Workspace and Microsoft environments, including Active Directory and Group Policy management.

• Ensure that Separation of Duties, secure remote access, Data Loss Prevention (DLP), access controls, and Mobile Device Management (MDM) comply with CUI requirements.

• Monitor configuration drift in relation to the CUI baseline.

• Assess new enterprise software and third-party vendors for compliance with security standards.

• Collaborate with Enterprise IT and IT/Cyber Operations teams to address findings.

• Provide evidence and technical responses to external C3PAO assessors, reporting posture and risk through Enterprise Cyber.

⛳️ Requirements

• U.S. citizenship required.

• Must be authorized to work in the United States.

• 5–8 years of experience in cybersecurity, with at least 3 years specifically focused on NIST SP 800-171 compliance and implementation.

• Experience in configuring and securing Google Workspace in a regulated environment, including compliance controls for Drive, Gmail, and endpoint management.

• Ability to conduct technical self-assessments, test controls, and gather evidence independently.

• Strong understanding of DFARS 252.204-7012/7019/7020, NIST SP 800-171, and CMMC Level 2 assessment guidelines.

• Active DoD 8570/8140 IAM Level II or III certification, such as CISSP, CISM, CASP+, or CAP.

• Ability to communicate technical requirements to non-technical leadership and document controls for external auditors clearly.

• Preferred: CMMC Certified Professional (CCP) or Registered Practitioner (RP).

• Preferred: Google Professional Cloud Security Engineer or Professional Google Workspace Administrator certification.

• Preferred: Active Secret or Top Secret clearance.

• Preferred: Experience as a formal Security Control Assessor (SCA) or Qualified Security Assessor (QSA).

• Preferred: Familiarity with EDR and SIEM tools.

🏝️ Benefits

• Performance bonus.

• Equity options.

• Medical insurance coverage.

• Dental insurance coverage.

• Vision insurance coverage.

• Paid Time Off (PTO).

• 401(k) retirement plan.