Security Automation, Cyber Security Engineer

This is a fully remote position, open to applicants in United States.

📋 Description

• Design, create, and uphold automated processes for gathering security and compliance evidence.

• Develop automation for security control assessments and continuous monitoring, incorporating OSCAL-based evidence collection and control-assessment functionalities.

• Construct integrations and data pipelines that aggregate and normalize security information from various tools, platforms, and APIs.

• Create security metrics and dashboards to provide near-real-time visibility into control posture, remediation status, vulnerabilities, and other security indicators.

• Automate recurring security and compliance reporting for security, engineering, program leadership, and government stakeholders.

• Establish capabilities to evaluate security control and tooling coverage across applications, infrastructure, and CI/CD pipelines.

• Automate vulnerability and remediation reporting, including prioritization, ownership, aging analysis, and closure tracking.

• Assist in the implementation and operation of an SBOM capability, encompassing the collection and analysis of software dependency and third-party component data.

• Integrate SBOM and software supply-chain information with vulnerability management and security reporting.

• Collaborate with DevSecOps Engineers to ensure that CI/CD and infrastructure security controls generate usable, repeatable compliance evidence.

• Identify manual security and compliance processes that are suitable for automation and implement scalable solutions.

• Support repeatable processes that allow product and engineering teams to demonstrate ongoing compliance with security standards.

• Ensure that automated security evidence, metrics, and reporting are traceable, maintainable, and usable during compliance activities and independent controls assessments.

• Document automation, integrations, data sources, processes, and technical solutions for long-term sustainability.

• Work alongside security engineers, cybersecurity/RMF specialists, DevSecOps engineers, software engineers, product teams, and government stakeholders.

• Support cybersecurity modernization for the Department of Veterans Affairs VA.gov Platform.

• Develop automation and data capabilities that enable continuous measurement of security requirements, evidence, vulnerabilities, remediation progress, and overall security posture.

⛳️ Requirements

• U.S. Citizen or Permanent Resident required.

• Associate's degree with four (4) years of relevant experience, or Bachelor's degree with two (2) years of relevant experience.

• Five (5) years of experience as a Cyber Security Engineer may be accepted in place of a degree.

• Experience in developing automation using Python, JavaScript, or another scripting/programming language.

• Experience in integrating data from APIs, cloud platforms, CI/CD systems, security tools, or other technical systems.

• Experience in designing or developing automated workflows, data pipelines, dashboards, metrics, or reporting solutions.

• Working knowledge of cybersecurity concepts, including security controls, vulnerability management, continuous monitoring, and compliance.

• Experience with modern software development and CI/CD practices.

• Ability to analyze security and technical data and convert it into meaningful metrics and actionable information.

• Strong written and verbal communication skills, along with the ability to collaborate across security, engineering, product, and program teams.

• Ability to obtain and maintain the background investigation and access necessary to support Department of Veterans Affairs systems.

• Preferred: experience in supporting federal cybersecurity programs or systems operating under the NIST Risk Management Framework (RMF).

• Preferred: knowledge of NIST SP 800-53 Rev. 5 security controls.

• Preferred: experience with OSCAL or other machine-readable approaches to security compliance and control assessment.

• Preferred: experience in automating security evidence collection, continuous monitoring, or compliance assessment.

• Preferred: experience with AWS security and configuration data, including AWS Security Hub and GuardDuty or similar tools.

• Preferred: experience in integrating security capabilities into or extracting security data from GitHub Actions or other CI/CD platforms.

• Preferred: experience with SAST, DAST, Software Composition Analysis (SCA), secrets detection, container scanning, or other application security tools.

• Preferred: experience implementing or working with SBOM standards and tools.

• Preferred: experience in software supply-chain security and dependency or third-party component risk analysis.

• Preferred: experience in developing security posture, vulnerability management, or compliance dashboards.

• Preferred: familiarity with federal ATO processes, POA&Ms, control implementation evidence, and independent controls assessments.

• Preferred: experience working within large-scale cloud platforms or environments that support multiple independent product and engineering teams.

• Standard business hours are Monday through Friday; occasional extended or weekend hours may be required.

• Must have reliable internet service that facilitates effective telecommuting.

🏝️ Benefits

• Medical, Dental, and Vision.

• Health Saving Account (when enrolled in an eligible plan) with Company contribution.

• Company paid Life, Accidental Death, Short-term & Long-term Disability.

• Voluntary Accident, Hospital Indemnity, & Critical Care Insurance.

• Voluntary Medical & Dependent Care Flexible Spending Accounts.

• Accrued Paid Time Off & Company Paid Holidays.

• 401(k) Retirement Plan with Company match.

• Reliable internet service for effective telecommuting.

• Occasional travel for customer meetings and industry events.