Cybersecurity Engineer – Product Development Lead

Leidos•Huntsville, AL

3d•$107,900 - $195,050•Onsite

About The Position

Leidos’ Defense Senior Research and Analysis Division is seeking a Cybersecurity Engineer-Product Development to work in its Huntsville, Alabama office. The role supports the development, integration, testing, production, delivery, and sustainment of complex defense systems and software products. The engineer works closely with systems, software, and hardware engineering; DevSecOps/IT; software assurance; configuration management; test and evaluation; manufacturing; program management; and government cybersecurity stakeholders. The position helps guide systems from initial requirements and architecture through design, implementation, integration, cybersecurity assessment, applicable Risk Management Framework (RMF) activities, qualification, production readiness, fielding, and sustainment. The role includes identifying cybersecurity requirements from applicable DoD policies, NIST publications, DFARS clauses, CMMC requirements, RMF controls, STIGs, program protection requirements, supply-chain risk management, and customer-specific requirements. It also supports security architecture and design reviews, vulnerability assessment and remediation, authorization documentation, and IATT, ATO, Assess-Only, or other program-appropriate assessment approaches. Authorization documentation should accurately reflect the engineered and production system.

Requirements

Bachelor’s degree in Cybersecurity, Computer Science, Computer Engineering, Software Engineering, Systems Engineering, Electrical Engineering, Information Technology, or a related technical discipline, plus 8 years of cybersecurity engineering experience; alternatively, a combination of education, military experience, and directly applicable engineering experience plus 11 years may be considered.
Strong understanding of secure system and software engineering principles.
Working knowledge of NIST SP 800-53, NIST SP 800-37 RMF, NIST SP 800-171, NIST SP 800-218 SSDF, and applicable DoD cybersecurity requirements.
Understanding of DoD RMF processes and security control implementation.
Experience developing cybersecurity requirements and verification criteria.
Ability to explain cybersecurity requirements to engineering, manufacturing, test, and program personnel.
Experience with cybersecurity risk assessment and vulnerability management.
Knowledge of secure software architecture and secure coding concepts.
Understanding of Linux security and system hardening.
Experience with vulnerability assessment technologies such as ACAS, Nessus, SCAP/STIG tools, or equivalent platforms.
Familiarity with SAST, DAST, SCA, dependency scanning, secrets scanning, and software supply-chain security.
Security+ or CISSP certification.
Must be a U.S. citizen and able to obtain and maintain an active Secret clearance.
Must reside in Huntsville, Alabama, or be willing to relocate to the Huntsville area.

Nice To Haves

Experience supporting cybersecurity for software-intensive or defense systems from development through test, production, and fielding.
Strong communication and documentation skills.
Ability to work in a highly technical, team-oriented environment that includes customers and coworkers.
Strong desire to learn and constantly improve.

Responsibilities

Identify cybersecurity requirements derived from DoD policies, NIST publications, DFARS clauses, CMMC requirements, RMF controls, STIGs, program protection requirements, SCRM, and customer-specific security requirements.
Assist Systems Engineering in establishing system security boundaries, trust boundaries, information flows, external interfaces, and cybersecurity assumptions and constraints.
Participate in system and software architecture development and design reviews.
Evaluate system architecture for cybersecurity weaknesses and recommend practical risk-reduction measures.
Provide cybersecurity engineering guidance for authentication, authorization, least privilege, encryption, key management, logging, auditing, secure communications, interface protection, network segmentation, and data protection.
Perform or coordinate vulnerability assessments using approved tools and capabilities, including ACAS/Nessus, SCAP/STIG assessment tools, SAST/SCA platforms, and network analysis tools.
Develop remediation recommendations in coordination with engineering teams.
Support preparation and maintenance of RMF artifacts, including system and data-flow diagrams, hardware/software inventories, ports/protocols/services information, security assessment results, vulnerability records, and POA&Ms.
Support IATT, ATO, Assess-Only, or other authorization and assessment approaches as applicable to the program.
Ensure authorization documentation accurately represents the engineered and production system.
Help shepherd systems through requirements, architecture, design, implementation, integration, cybersecurity assessment, qualification, production readiness, fielding, and sustainment.