About the role
cFocus Software seeks a Information System Security Engineer (ISSE) to join our program supporting the United States Air Force (USAF). This position is on-site in Linthicum Heights, MD. This position requires an Active TS/SCI clearance. Qualifications: * Active TS/SCI clearance * B.S. Computer Science, Information Technology, or a related field * Experience implementing and validating security controls for enterprise systems and infrastructure. * Knowledge of RMF, authorization boundaries, control assessments, and compliance evidence. * Experience with STIGs, secure configurations, vulnerability analysis, and remediation validation. * Ability to engineer security across networks, operating systems, applications, and cloud services. * Experience with scripting, IaC/CaC, source control, and security integration in CI/CD workflows. * Experience configuring logging, monitoring, alerting, and security tool integrations. * Ability to document designs, test results, configurations, and remediation recommendations clearly. * Strong collaboration skills across architecture, cybersecurity, development, and operations teams
Duties: * Translate Government-approved security architecture, system requirements, and DoD compliance requirements into implementable technical controls and engineering tasks. * Implement and validate controls enforcing Government-defined authorization boundaries across assigned infrastructure, applications, and cloud services. * Engineer secure configurations for networks, servers, applications, and supporting services; evaluate proposed changes for security and integration impacts. * Develop and maintain automation scripts that apply Security Technical Implementation Guides (STIGs) and document system configurations and network diagrams from live environments. * Integrate Government-specified cybersecurity controls and security guardrails into Continuous Integration/Continuous Deployment (CI/CD) pipelines. * Implement Infrastructure as Code (IaC) and Configuration as Code (CaC) using centralized repositories and approved baselines; support automated security evaluation before production deployment. * Configure and validate logging, monitoring, observability, and alerting across authorization boundaries in accordance with approved plans. * Analyze vulnerability and configuration assessment findings; recommend corrective actions, implement approved fixes, and verify remediation effectiveness. * Support security testing and assessments by defining technical validation steps, collecting evidence, and resolving identified engineering deficiencies. * Provide technical evidence, configuration records, test results, and monitoring data supporting Risk Management Framework (RMF), Authorization to Operate (ATO), Assess-Only Authorization, and continuous ATO (cATO) activities. * Support integration of Cybersecurity Service Provider (CSSP) capabilities and Government-approved cross-domain solutions within assigned security architecture and impact levels. * Coordinate system-level findings and remediation status with ISSOs and the ISSM; supply engineering analysis for Plans of Action and Milestones (POA&Ms) and risk recommendations. * Support incident response through approved technical procedures, log analysis, control corrections, and directed recovery or remediation activities. * Maintain design and as-built documentation, configuration traceability, and implementation procedures; recommend improvements to security automation and monitoring.