Cybersecurity Engineer

Carnegie Mellon University•Pittsburgh, PA

6d•Onsite

About The Position

As part of Carnegie Mellon University's Cyber Risk and Resilience Directorate, the Cybersecurity Engineer supports the operational capabilities and evolution of the Cybersecurity Assurance Team (CA Team), focusing on cybersecurity, operational resilience, and applied research. The team develops frameworks, models, tools, policies, practices, technical guidance, and training to help industry, government, and military organizations measure and improve management of operational and technical risks to mission-critical services, including risks associated with changing technologies such as artificial intelligence and agentic systems. The engineer consults directly with mission partners and subject matter experts across the CA portfolio; supports standardized cybersecurity assessments; develops and applies security measurement approaches; and shares expertise with the broader community. Working on multidisciplinary teams, the engineer addresses customer challenges in varied environments and serves as a trusted advisor to defense and critical infrastructure customers. The role also offers opportunities to research approaches to cybersecurity resilience, including cyber operations, artificial intelligence, continuity planning and management, and organizational and social implications and mitigations related to cyber incidents and failures. The position includes leading customer engagements, contributing to cybersecurity projects, representing the Software Engineering Institute (SEI) and its work to stakeholders, engaging with research and technology communities through publications and presentations, and continuing professional development. Frequent travel of 15–35% is required. The successful candidate must be able to obtain and maintain a Department of War security clearance and be legally authorized to work for CMU in the United States; CMU will not sponsor or take over sponsorship of an employment visa.

Requirements

Bachelor's degree in a relevant discipline and 8 years of applicable experience, or a master's degree in a relevant discipline and 5 years of applicable experience, or a Ph.D. in a relevant discipline and 2 years of applicable experience.
Track record of successfully leading projects in a technical discipline and driving user-centered, high-impact outcomes.
Ability to lead diverse teams in analyzing and solving real-world problems, developing engineering guidance, and applying or tailoring SEI and non-SEI technologies and resources.
Ability to lead through influence beyond one's immediate team or span of control.
Experience contributing to multiple simultaneous projects and working effectively in a creative, high-energy environment.
Willingness to experiment with new practices and develop effective processes, practices, and infrastructure to support successful projects.
Strong communication skills, including the ability to collaborate diplomatically with customers and colleagues at all levels, understand the big picture and technical details, and present complex ideas to people without deep subject-area knowledge.
Ability to obtain and maintain a Department of War security clearance, subject to a background investigation.
Currently legally authorized to work for CMU in the United States; CMU will not sponsor or take over sponsorship of an employment visa.
Frequent travel of 15–35% to SEI and CMU community locations, customer sites, conferences, and offsite meetings.
Ability to deal collaboratively and diplomatically with customers, coworkers, professional colleagues, managers, and staff.

Nice To Haves

Industry experience at a mid-to-senior level managing information security risks and implementing controls.
Industry experience at a mid-to-senior level managing technology controls and risks, such as change management, infrastructure, capacity planning, availability, cloud services, and technology implementations.
Industry experience at a mid-to-senior level managing continuity-related controls and risks, such as business continuity and disaster recovery.
Experience deploying information technology, including implementing security technology or designing, building, and maintaining networks.
Consulting experience with private industry or government customers, including leading projects and engagements.
Familiarity with cybersecurity and resilience standards such as NIST CSF, NIST SP 800 series, and ISO 27000 series.
Knowledge of audit and assessment methodologies, tactics, techniques, and procedures.
Knowledge of critical infrastructure protection concepts and standards.
Understanding of maturity model concepts, such as CMMI and the Financial Sector Cyber Profile.
Strong writing and editing ability.
Ability to work with others as a member of a process action team or instructional design working group.
Experience with course and information mapping, flowcharting, or similar work.
Certifications such as A+ CE, CCNA-Security, CND, Network+ CE, SSCP, CISSP, CISM, CISA, or PMP, or equivalent experience.
Military experience may be beneficial for understanding the institute's mission and stakeholders, but is not required.

Responsibilities

Lead customer engagements and represent the Cybersecurity Assurance Team's and SEI's work to mission partners.
Contribute to customer projects that advance the state of the art in cybersecurity.
Present SEI's mission and work to stakeholders.
Engage with communities of interest through publications and presentations, and build and maintain relationships with relevant research and technology communities.
Continue developing cybersecurity knowledge and skills and stay current on emerging trends relevant to the team's portfolio.
Consult with mission partners and subject matter experts across the Cybersecurity Assurance portfolio.
Support cybersecurity assessment standardization and develop and apply security measurement approaches.
Transition cybersecurity and resilience knowledge and expertise to the broader community.
Collaborate on multidisciplinary teams to solve customer challenges and advise defense and critical infrastructure customers.
Conduct research into methods for managing cybersecurity resilience across areas including cyber operations, artificial intelligence, continuity planning, and organizational and social impacts of cyber incidents and failures.
Mentor, motivate, and empower less-experienced team members.