Cyber Eng Prin

BAE Systems•Hill AFB, UT

9d•Onsite

About The Position

Air and Space Force Solutions, a business unit within BAE Systems, has an opening at our Hill Air Force Base, Utah location for a Principal Cybersecurity Engineer. The selected candidate will join our Information Services team and have an important role in supporting our mission of Strategic Deterrence through continual improvement and innovation. The position will have the following duties and responsibilities: Fulfill the ISSE responsibilities defined in DoD Instructions 8500.01 and 8510.01, AFI17-101 Risk Management Framework (RMF) for the Air Force Information Technology (IT), and the "DoD Program Manager's Guidebook for Integrating the Cybersecurity Risk Management Framework (RMF) into the System Acquisition Lifecycle" Coordinate closely with the ISSMs to ensure compliance with DoD Instructions 8500.01 and 8510.01, AFI17-101 Risk Management Framework (RMF) for the Air Force Information Technology (IT), and the "DoD Program Manager's Guidebook for Integrating the Cybersecurity Risk Management Framework (RMF) into the System Acquisition Lifecycle" Support efforts to integrate Cybersecurity throughout the lifecycle of IT systems. This includes the development and review of Cybersecurity-related artifacts, including System Security Plans, Cyber Security Strategies, Cybersecurity Impact Assessments, policies, plans, and procedures Continually assess activities and controls to secure information. Assess gaps in security and identify solutions to mitigate risk, including business processes, technical controls, and policy improvements Assist in the development of security policies, plans, and procedures to meet government regulations and industry best practices Develop security impact analyses Review technical assessments Use automated tools to analyze system security control compliance Collaborate with technical managers to ensure required controls are implemented and security processes are followed Build collaborative internal relationships with program and project teams, as well as external relationships with customers, regulatory bodies, other agencies and business partners Perform other duties as assigned

Requirements

The applicant must meet DoD 8570.01-M IAT Level II, IAM Level I or higher certification requirements on hire date.
Bachelor's degree in Computer Science, Cybersecurity, Information Technology, or a related Engineering field and a minimum of 7 years experience, or Master's degree (MS or MBA) and 5 years of relevant experience
Certification such as: CISSP; CISSP-ISSEP; CASP+ CE (CompTIA SecurityX); CSSLP
Professional experience in information security, with a proven track record of leading large-scale projects
Experience designing and implementing secure network architectures, Zero Trust environments, and cloud security frameworks (AWS, Azure, or GCP)
Deep experience operating within regulatory frameworks such as NIST (800-53, 800-171), ISO 27001, CMMC, or SOC2
Incident Response: Experience leading high-severity security incident responses and conducting post-mortem root cause analyses
Threat Modeling: Proficiency in using frameworks like STRIDE or PASTA to identify vulnerabilities
Security Tooling: Expert-level knowledge of SIEM (Splunk, Sentinel), EDR/XDR, Firewalls, and Vulnerability Scanners (Nessus, Qualys)
Identity & Access Management (IAM): Expertise in OAuth, SAML, and multi-factor authentication (MFA) implementation
Secure Coding/DevSecOps: Ability to integrate security into the CI/CD pipeline using SAST (Static Analysis) and DAST (Dynamic Analysis) tools
Strategic Planning: Ability to translate business requirements into a technical security roadmap
Stakeholder Management: Capable of communicating complex technical risks to non-technical executives to secure budget and buy-in

Nice To Haves

Experience transitioning security postures across different environments, such as moving a legacy on-premises system to a hybrid-cloud or fully cloud-native environment
In the context of defense and aerospace, a preference for candidates with experience in Cross-Domain Solutions (CDS), air-gapped networks, and highly classified environments
Proven experience as a "Lead" or "Architect" where the candidate was responsible for the security roadmap of an entire product line or business unit
A history of contributing to the security community through white papers, conference presentations (e.g., DEF CON, Black Hat), or open-source security projects
Proficiency in Python, Go, or PowerShell to automate security responses (SOAR) and infrastructure as code (Terraform, Ansible)
Deep understanding of PKI (Public Key Infrastructure), quantum-resistant encryption, and hardware security modules (HSMs)
The ability to not only defend but to simulate advanced persistent threats (APTs) to test the resilience of the organization
Ability to apply machine learning (ML) and AI to anomaly detection and threat hunting

Responsibilities

Fulfill the ISSE responsibilities defined in DoD Instructions 8500.01 and 8510.01, AFI17-101 Risk Management Framework (RMF) for the Air Force Information Technology (IT), and the "DoD Program Manager's Guidebook for Integrating the Cybersecurity Risk Management Framework (RMF) into the System Acquisition Lifecycle"
Coordinate closely with the ISSMs to ensure compliance with DoD Instructions 8500.01 and 8510.01, AFI17-101 Risk Management Framework (RMF) for the Air Force Information Technology (IT), and the "DoD Program Manager's Guidebook for Integrating the Cybersecurity Risk Management Framework (RMF) into the System Acquisition Lifecycle"
Support efforts to integrate Cybersecurity throughout the lifecycle of IT systems. This includes the development and review of Cybersecurity-related artifacts, including System Security Plans, Cyber Security Strategies, Cybersecurity Impact Assessments, policies, plans, and procedures
Continually assess activities and controls to secure information. Assess gaps in security and identify solutions to mitigate risk, including business processes, technical controls, and policy improvements
Assist in the development of security policies, plans, and procedures to meet government regulations and industry best practices
Develop security impact analyses
Review technical assessments
Use automated tools to analyze system security control compliance
Collaborate with technical managers to ensure required controls are implemented and security processes are followed
Build collaborative internal relationships with program and project teams, as well as external relationships with customers, regulatory bodies, other agencies and business partners
Perform other duties as assigned