CyberSecurity Engineer

Spatial Front, Inc.•Arlington, VA

12d•$120,000 - $150,000•Hybrid

About The Position

Spatial Front, Inc. (SFI), a two-time USA Today Top Workplaces awardee and Washington Top Workplaces honoree, is a fast-growing federal technology solutions provider. We bring together innovative technologies, industry best practices, and top-notch talent to address our federal clients’ most critical mission needs. As an ISO 9001, 20000, 27001, and CMMI Level 3 certified organization, SFI delivers high-impact cybersecurity, enterprise IT, and cloud engineering across the public sector. At SFI, you will work alongside subject matter experts in an open, collaborative environment dedicated to continuous learning and technical excellence. Spatial Front is seeking a Cybersecurity Engineer to support and secure mission-critical infrastructure across a large enterprise environment comprising 900+ servers. In this role, you will lead hands-on vulnerability management, security compliance, and Risk Management Framework (RMF) authorization processes. You will serve as a technical expert responsible for continuous scanning, STIG application, POAM tracking, and remediation strategies to safeguard our federal client’s assets.

Requirements

Must be a U.S. Citizen with an active Secret Clearance (or ability to obtain/pass a federal background investigation).
Bachelor’s degree in Cybersecurity, Information Technology, Computer Science, or related field (or equivalent operational experience) + 5+ years of dedicated cybersecurity engineering experience.
Active CompTIA Security+ (IAT Level II compliant).
Proven experience conducting ACAS scans and vulnerability analysis across large environments (900+ servers).
Direct experience applying and evaluating DISA STIGs at enterprise scale.
Deep working knowledge of DoD RMF processes and direct experience navigating eMASS.
Strong proficiency in writing, managing, and closing out POA&Ms.

Nice To Haves

Hands-on experience with Identity, Credential, and Access Management (ICAM), including user provisioning, role-based access control (RBAC), and access review tracking.
Practical experience analyzing audit logs, building dashboards, and configuring security alerts using Splunk and Audit Vault systems.
CISSP (Certified Information Systems Security Professional), CISM, or CASP+.
Experience with automated vulnerability/patch management tooling and scripting (e.g., PowerShell, Python, or Bash).

Responsibilities

Perform automated and credentialed enterprise vulnerability scans across 900+ Windows/Linux server assets using Assured Compliance Assessment Solution (ACAS / Tenable.sc).
Analyze raw scan results, evaluate true/false positives, prioritize risk, and coordinate patch/remediation workflows with systems administrators.
Execute end-to-end Security Technical Implementation Guide (STIG) application and evaluation across large-scale server infrastructures.
Validate compliance utilizing DISA STIG Viewer and automated benchmarks (SCAP Content).
Lead and support Risk Management Framework (RMF) Steps 1 through 6 lifecycle activities.
Prepare, maintain, and upload standard compliance artifacts into Enterprise Mission Assurance Support Service (eMASS) to maintain continuous Authority to Operate (ATO) posture.
Author, manage, and track Plans of Action and Milestones (POA&Ms) for open vulnerabilities and non-compliant controls.
Work with stakeholders to define mitigation strategies, root cause analyses, and realistic completion milestones.
Drive continuous monitoring strategies, presenting vulnerability and compliance metrics to agency leadership and federal stakeholders.