Information Systems Security Engineer

Booz Allen Hamilton•Fort Meade, MD

7d•$99,000 - $225,000

About The Position

The Information Systems Security Engineer applies cybersecurity, risk management, and secure system design expertise to protect mission systems and AI-enabled capabilities. The role identifies security controls, assessment tools, and authorization strategies for integrating emerging technologies into operational, research, and enterprise environments. It guides and mentors professionals addressing cybersecurity challenges, performing assessments, and remediating vulnerabilities across varied systems and architectures. The engineer leads the creation and maintenance of Risk Management Framework (RMF) authorization packages and Authority to Operate (ATO) processes, and oversees cybersecurity artifacts such as system security plans and plans of action and milestones. Using tools including ACAS, SCAP, and eMASS, the role evaluates risk, supports compliance with STIGs and IAVM directives, and coordinates vulnerability remediation across project teams. The position also embeds cybersecurity practices into AI development pipelines and integrates security throughout the system lifecycle, collaborating with DevOps, cloud architects, and AI and ML engineers. Applicants must hold a TS/SCI clearance with a polygraph and meet one of the stated education and experience combinations: a high school diploma or GED with at least six years of cybersecurity experience, or a bachelor's degree with at least four years of cybersecurity experience. Compensation is projected at $99,000 to $225,000 annually. Booz Allen describes benefits including health, life, disability, financial and retirement benefits, paid leave, professional development, tuition assistance, work-life programs, dependent care, and recognition awards. Benefit-program eligibility depends on hours worked.

Requirements

Experience with the Risk Management Framework (RMF), including creation and maintenance of authorization packages, ATOs, and re-authorizations.
Experience conducting security assessments, vulnerability remediation, and continuous monitoring in alignment with RMF.
Experience with compliance scanning and vulnerability management tools, especially ACAS and SCAP.
Experience implementing cybersecurity directives such as IAVM directives, CPUs, and STIGs.
Experience updating and maintaining eMASS, including scan results, documentation, and evidence packages.
Knowledge of system lifecycle management and procurement cybersecurity requirements.
Ability to prepare and maintain cybersecurity documentation, including SSPs, SARs, and POA&Ms.
Ability to analyze system architectures, hardware, and software designs to identify and mitigate security risks.
TS/SCI clearance with a polygraph.
High school diploma or GED and at least 6 years of cybersecurity experience, or a bachelor's degree and at least 4 years of cybersecurity experience.

Nice To Haves

Experience securing AI-enabled or ML-driven systems.
Experience with cloud and hybrid architectures, particularly securing AI workloads across varied computing environments.
Experience with DevSecOps tooling, CI/CD security integration, and automated compliance workflows.
Experience working with cross-functional AI and ML development teams on secure model training, deployment pipelines, and monitoring frameworks.
Experience in secure software development or secure architecture design reviews.
Experience with cybersecurity automation scripting such as Python, PowerShell, or Ansible for STIG automation, scanning pipelines, or infrastructure-as-code security controls.
Knowledge of DoD-specific cybersecurity governance frameworks, mission workflows, and operational environments, including USCYBERCOM or DoW environments.

Responsibilities

Identify security controls, assessment tools, and authorization strategies for integrating emerging technologies into operational, research, and enterprise environments.
Guide and mentor professionals conducting cybersecurity analysis, security assessments, and vulnerability remediation.
Lead creation and maintenance of RMF authorization packages and manage ATO and re-authorization processes.
Oversee cybersecurity artifacts, including system security plans, security assessment reports, and plans of action and milestones.
Use ACAS, SCAP, and eMASS to evaluate system risks and maintain compliance evidence and documentation.
Ensure compliance with STIGs, IAVM directives, and other cybersecurity directives, and coordinate vulnerability remediation across project teams.
Embed cybersecurity best practices into AI development pipelines and integrate security throughout the system lifecycle.
Analyze system architectures, hardware, and software designs to identify and mitigate security risks.
Collaborate with DevOps, cloud architects, and AI and ML engineers to develop secure solutions.