Cybersecurity Engineer

ThinkTek•Mechanicsburg, PA

About The Position

ThinkTek LLC is seeking an experienced Cybersecurity Engineer to support a Federal Government customer. This role involves providing advanced cybersecurity engineering, assessment, and compliance support. The engineer will be responsible for implementing and assessing security controls, maintaining system authorization packages, conducting security assessments, and supporting risk-based authorization decisions for mission-critical systems. The position requires working across traditional, cloud-native, and SaaS environments, supporting initiatives like the Risk Management Framework (RMF), Cybersecurity Risk Management Construct (CSRMC), Continuous Authorization to Operate (cATO), and Zero Trust. Expertise in cybersecurity engineering, security compliance automation, cloud security, vulnerability analysis, risk assessment, and GRC processes is essential. A Secret security clearance is mandatory.

Requirements

Active Secret Security Clearance.
Bachelor's degree in Information Technology, Computer Science, Engineering or a related technical field from an accredited college or university.
Minimum 5 years of dedicated Information Assurance, Cybersecurity, or Information Security experience.
At least 3 consecutive years of recent experience supporting DoD cybersecurity programs.
Experience with Risk Management Framework (RMF) authorization processes.
Experience administering and maintaining eMASS authorization packages.
Experience conducting security control assessments, validations, and risk assessments.
Experience supporting ATO, cATO, and continuous monitoring programs.
Experience analyzing vulnerabilities, security findings, and organizational risk posture.
Experience supporting cloud security initiatives in AWS, Azure, or other FedRAMP-authorized environments.
Strong understanding of NIST 800-53 security controls and DISA STIG requirements.
One DoD 8570/8140 IAM Level II or IAT Level II baseline requirement (e.g., CISSP, Security+ CE, CISM, CASP+ CE).

Responsibilities

Serve as the lead cybersecurity engineer and Information System Security Officer (ISSO) supporting a portfolio of DSCA mission systems across on-premises, cloud, and SaaS environments.
Lead RMF and CSRMC activities, including system authorization, continuous monitoring, and maintenance of ATO/cATO packages.
Manage and maintain eMASS records, authorization artifacts, control implementation evidence, and Plans of Action & Milestones (POA&Ms).
Assess and validate NIST 800-53, DoD RMF, DISA STIG, FedRAMP, and DoD Cloud Computing Security Requirements Guide (CC SRG) security controls.
Conduct security control assessments and independent validations to evaluate control effectiveness and support risk-informed authorization decisions.
Develop Security Assessment Plans (SAPs), Security Assessment Reports (SARs), Risk Assessment Reports (RARs), and authorization recommendation memorandums.
Analyze vulnerabilities, security findings, automated scan results, and threat data to assess mission impact and prioritize remediation activities.
Review and validate Compliance-as-Code (CaC), Policy-as-Code (PaC), and automated security assessment outputs to ensure accuracy and compliance.
Collaborate with system owners, developers, engineers, and program stakeholders to implement security controls, address findings, and reduce enterprise risk.
Support DevSecOps and cloud security initiatives by integrating security throughout the system development lifecycle and continuous delivery processes.
Monitor security posture across AWS cloud, traditional infrastructure, and SaaS platforms, ensuring compliance with federal and DoD cybersecurity requirements.
Brief government leadership and Authorizing Officials on system risk posture, assessment results, remediation strategies, and authorization recommendations.