Security Engineer

This is a fully remote position, open to applicants in United States.

📋 Description

• Act as the security lead for a FIPS 199 Moderate federal platform that supports governmentwide regulatory planning and review.

• Safeguard and ensure the availability of both legacy and modernized platforms.

• Implement hardening, patching, and maintain compliance for Java, Oracle, and Red Hat environments.

• Conduct vulnerability scans and oversee remediation and patching for Red Hat Enterprise Linux, Oracle, Apache/Tomcat, and Java application components.

• Adhere to contractual remediation timelines and document Plans of Action and Milestones (POA&Ms) when deadlines cannot be met.

• Strengthen systems in accordance with GSA security benchmarks and CIS Level 1 guidelines.

• Monitor end-of-life software, unsupported libraries, and known vulnerabilities; communicate risks along with suggested solutions.

• Assist in continuous monitoring, log review, incident response, Continuity of Operations (COOP), and disaster recovery planning and testing.

• Maintain the Authorization and Assessment (A&A) package as per NIST SP 800-37 and SP 800-53 Rev. 5.

• Manage POA&Ms and aid government-led security assessments, control reviews, and penetration testing.

• Contribute to the development of privacy compliance artifacts, including Privacy Threshold Assessments and Privacy Impact Assessments.

• Execute threat modeling for new features, integrations, and architectural decisions.

• Integrate static and dynamic security testing, such as Snyk and OWASP ZAP, into CI/CD pipelines.

• Assess releases for security implications prior to production deployment.

• Provide guidance on secure architecture, federated identity, FIPS 140-validated encryption, Zero Trust principles, and securing the software supply chain.

• Prepare security packages for prototype testing and position the new platform for an Authority to Operate (ATO).

• Offer expertise on Public Key Infrastructure (PKI), firewall and network security, internet protocols, and configuration management.

• Serve as the primary security contact for the client and update technical leads and the Project Manager.

• Collaborate with client IT teams on infrastructure modifications and verify system security.

• Perform other relevant duties as assigned and for which you are qualified or trained.

⛳️ Requirements

• Bachelor’s degree in Cybersecurity, Computer Science, Information Systems, or a related discipline.

• Minimum of 5 years of practical information security experience, including securing federal information systems in accordance with FISMA.

• Proficient hands-on experience with the NIST Risk Management Framework, particularly in implementing and evaluating NIST SP 800-53 Rev. 5 controls at the Moderate baseline.

• Demonstrated experience in creating and maintaining A&A documentation, including System Security Plans, contingency plans, incident response plans, and POA&Ms, while supporting a system through ATO.

• Familiarity with running vulnerability scanning tools such as Tenable/Nessus or Qualys.

• Experience in hardening Linux systems, preferably Red Hat Enterprise Linux, and relational databases, ideally Oracle, against CIS or agency benchmarks.

• Solid understanding of application security, including the OWASP Top 10 and ASVS, static and dynamic testing tools, and securing CI/CD pipelines.

• Knowledge of public key infrastructure, TLS certificate management, firewall configurations, and network protocols.

• Strong and clear communication skills, capable of articulating risks and trade-offs to both technical and non-technical stakeholders, including client leadership.

• Ability to obtain and maintain a favorable Public Trust determination for a federal government contract.

• Must be legally authorized to work in the United States.

• Bixal does not offer visa sponsorship.

• Security certifications such as CISSP, CISM, CompTIA Security+, or equivalent are preferred.

• Experience with GSA IT security policies, cloud-hosted or containerized platforms, Zero Trust architecture, identity federation, monitoring/logging tools, and transitioning from legacy to modern platforms is a plus.

🏝️ Benefits

• Flexible working hours.

• 401K plan with matching incentives.

• Parental leave.

• Comprehensive medical, dental, and vision benefits.

• Flexible Spending Account.

• Company-provided short-term disability and life insurance.

• Commuter benefits.

• Paid Time Off (PTO).

• 11 paid holidays.

• Reasonable accommodations for disabilities.

• Support for professional development and an inclusive, purpose-driven culture.