Cybersecurity Engineer II (InSITE) - Secret Clearance

V2X•Orlando, FL

About The Position

V2X is seeking a Cybersecurity Engineer II to serve as the lead cybersecurity engineer for the InSITE application within the W-TRS program and Global Training Solutions (GTS). The role provides technical leadership for cybersecurity planning and assessments, including static and dynamic application security testing, penetration testing, monthly vulnerability assessments, quarterly STIG reviews, and RMF/ATO and continuous monitoring. The engineer drives the security posture of the InSITE solution across development, test, and production environments and may support other cyber projects as needed. The position works with development teams, system administrators, system owners, managers, customers, and other stakeholders to identify and manage security risks, coordinate remediation, maintain compliance, and produce technical reports and documentation. The successful candidate must be able to obtain and maintain a Secret security clearance and be a U.S. citizen.

Requirements

Bachelor’s degree in Cybersecurity, Computer Science, Information Systems, Engineering, or a related field, or an equivalent combination of education and experience.
Typically 3–6 years of cybersecurity, system security engineering, or closely related experience.
Proven experience leading application security assessments, including SAST/DAST and vulnerability scans, for complex systems.
Proven experience with DISA STIG/SRG-based hardening for servers, applications, and databases.
Proven experience with RMF/ATO efforts and continuous monitoring for government or regulated systems.
Proven experience with vulnerability scanning and management in multi-environment deployments.
Expert knowledge of application security, OWASP Top 10, and secure SDLC practices.
Strong experience managing vulnerabilities across development, test, and production environments and working with Windows Server, IIS, SQL/Azure SQL, and cloud-hosted environments.
Hands-on experience with enterprise vulnerability tools such as Tenable/Nessus, Qualys, or Rapid7.
Hands-on experience with application security tools such as SonarQube, Fortify, Veracode, Burp Suite, or OWASP ZAP.
Hands-on experience with DISA STIGs and DoD SRGs and their implementation in production environments.
Solid understanding of NIST SP 800-53, NIST RMF, and ATO/continuous monitoring requirements.
Ability to obtain and maintain a Secret security clearance for the W-TRS program.
U.S. citizenship.
Demonstrated ability to lead cross-functional security initiatives and remediation and collaborate effectively with managers, customers, and stakeholders.
Excellent written and verbal communication skills for technical reporting and presenting complex security issues to varied audiences.
Strong analytical and decision-making skills, balancing mission needs, risk, and compliance.

Nice To Haves

Azure cloud security experience is preferred.
DoD 8570/8140-compliant certification at IAT Level II or higher, such as Security+, CySA+, or GSEC, is strongly preferred.
Offensive or advanced security certifications, such as OSCP, OSWE, GPEN, or GCIH, are desirable.

Responsibilities

Provide programmatic cybersecurity support, including planning and estimating cybersecurity tasks and representing cybersecurity at technical interchange meetings and Agile ceremonies.
Troubleshoot, resolve, or escalate security issues across development, test, and production environments.
Plan and execute static application security scans each sprint; analyze results, identify false positives, prioritize vulnerabilities, collaborate on remediation, track status, and verify closure through re-scans.
Plan and execute web application security scans for each release using approved dynamic application security testing tools; interpret results, prepare actionable findings, and coordinate remediation.
Prepare and configure monthly vulnerability scans of virtual servers and infrastructure across development, test, and production environments, covering approximately 20 servers.
Analyze, correlate, deduplicate, and prioritize vulnerability findings; document risks and remediation recommendations and coordinate remediation with system owners.
Update security documentation, dashboards, and continuous monitoring records.
Conduct quarterly DISA STIG and SRG reviews for applicable systems and technologies, document compliance status and residual risk, maintain checklists, and ensure system baselines reflect updates.
Assist in scoping and planning penetration tests, including rules of engagement; perform or support testing under senior staff guidance and contribute technical findings and recommended mitigations to reports.
Contribute to the development and maintenance of the Security Authorization Package, provide control implementation evidence, participate in control assessments, and support POA&M management.
Perform continuous monitoring activities, including periodic scans, log review support, and compliance status updates.
Produce vulnerability and scan reports and update run books, procedures, and standard operating instructions for assessment activities.
Provide guidance and mentorship to junior cybersecurity staff as needed.
Perform other duties as assigned in support of W-TRS and GTS.