SECURITY & COMPLIANCE ENGINEER (SCE)

SME Area #1 – Primary Expertise: Technical Risk Validation (Modern GRC Execution)

Expert-level means:

• Ability to independently assess systems using direct technical inspection techniques, leveraging logs, configs, architecture documents, etc.
• Deep working knowledge of critical frameworks and directives such as: NIST RMF (800-37, 800-53, etc.) FISMA, EO 14028, OMB M-21-31 / M-22-09 FIPS 199/200 TIC 3.0 and Zero Trust principles (CISA ZT MM, NIST 800-207, etc.)
• NIST RMF (800-37, 800-53, etc.)
• FISMA, EO 14028, OMB M-21-31 / M-22-09
• FIPS 199/200
• TIC 3.0 and Zero Trust principles (CISA ZT MM, NIST 800-207, etc.)
• Ability to identify threat surfaces within specific systems, not just control gaps
• Ability to convert compliance requirements into specific and actionable remediation actions that the system teams can be used to successfully remediate findings

• Vulnerability scanning tools such as: Tenable, Qualys, CrowdStrike, etc.
• Log analysis platforms such as: Splunk, Microsoft Sentinel, IBM QRadar, etc.
• Configuration and system inspection tools such as: Ansible, Terraform, Puppet etc.
• GRC platforms such as: Archer, ServiceNow, etc.

SME Area #2 – Secondary Expertise: Multi-Domain Technical Depth

You must have deep knowledge of one or more of the following technical domains and must demonstrate the ability to leverage this experience to inform and complete compliance-related tasks.

• Cloud: AWS/Azure (IAM, logging, network security, misconfigurations)
• Network: Segmentation, firewalls, boundary protections, Zero Trust enforcement points
• Systems: Windows/Linux hardening, identity systems (AD, MFA)
• Databases/Data: Access control, encryption, auditing

• 5+ years of cybersecurity experience supporting U.S. Government systems
• 4+ years performing RMF, ISSO, Assessment, or GRC functions with direct technical validation responsibilities
• Demonstrated hands-on experience in at least two technical domains (cloud, network, systems, or databases)
• Proven ability to analyze: System configurations, ATOs, and other supporting security documentation Logs/telemetry Architecture documentation and data flow diagrams
• System configurations, ATOs, and other supporting security documentation
• Logs/telemetry
• Architecture documentation and data flow diagrams

• Experience implementing or assessing Zero Trust architectures
• Experience with CDM, ISCM, and enterprise logging programs
• Familiarity with threat-informed defense concepts
• Experience in hybrid cloud environments

• Technical risk identification and prioritization
• Independent problem-solving in ambiguous environments
• Ability to translate policy into technical action
• Clear communication with both engineers and leadership

• Bachelor of Science (B.S.) in Computer Science, IT, Cybersecurity, or a related field, and a minimum of 5 years of IT cybersecurity experience, including direct support for the US Government and 4 years acting as an ISSO, Assessor, Compliance, RMF, or GRC with a technical validation role.
• Without a B.S. in a relevant field - A minimum of 10 years of IT Cybersecurity experience, including direct support for the US Government, and 4 years acting as an ISSO, Assessor, Compliance, RMF, or GRC with a technical validation role.
• At least one of the following security certifications is required: Certified Authorization Professional (CAP) Certified Information Security Auditor (CISA) Certified Information Security Manager (CISM) Certified Information Systems Security Professional (CISSP), or Certified Chief Information Security Officer (CCISO) Governance Risk & Compliance Certification (CGRC) Or alternatively approved certifications

• Certified Information Systems Security Professional (CISSP), or Certified Chief Information Security Officer (CCISO)

• Or alternatively approved certifications

Minimum of active Secret Clearance and ability to obtain and maintain DHS suitability

• The position is primarily remote – Continental U.S only
• Primary location when on site: Arlington, VA, and Springfield, VA
• Must be willing to travel - Not to exceed 10% of the time

• 8:00 am EST – 4:30 pm EST
• Times may fluctuate based on client and business requirements

• Reports To: Security Compliance Engineering Team Lead