Information Systems Security Engineer (ISSE)- IDCS(M)

Semper Valens Solutions•San Antonio, TX

1d•Onsite

About The Position

The Digital Modernization Sector is seeking an experienced Information Systems Security Engineer (ISSE) to support the USAF Defensive Cyber Systems Program Management Office (PMO) at Joint Base San Antonio. This role directly supports the Information Assurance (IA) team by engineering, integrating, and maintaining cybersecurity solutions that enable and sustain multiple Authority to Operate (ATO) authorizations. The ISSE will focus on building systems, pipelines, and processes that collect, generate, and validate required RMF artifacts, reducing manual effort and accelerating authorization timelines. The ideal candidate is a hands-on cybersecurity engineer with strong experience in vulnerability management, STIG compliance, automation, and system integration across Windows, Linux, and containerized environments. This role bridges the gap between engineering and authorization, ensuring systems are both secure and audit ready.

Requirements

Able to work On-Site at Port San Antonio, Texas
BS degree in Cybersecurity, Computer Science, Engineering, or related field and 8–12 years of relevant experience (or equivalent experience)
Active Top Secret/SCI Clearance (required)
DoD 8140 certification (e.g., CISSP, or equivalent)
Strong hands-on experience with: ACAS (Tenable.sc / Nessus), SCAP and SCC tools, STIG implementation and validation (STIG Viewer, STIG checklists), eMASS and RMF processes (ATO, IATT, continuous monitoring)
Experience supporting: NIST RMF (800-37) and 800-53 controls, DoD ATO processes and artifact development, POA&M development and management
Strong technical experience with: Linux (RHEL) and Windows systems, Scripting/automation (Python, Bash, PowerShell), Virtualization (VMware vSphere / ESXi)
Ability to: Interpret vulnerability data and map to security controls, Translate technical findings into RMF artifacts, Work across engineering and IA teams effectively
Strong communication skills and ability to work in a cross-functional, high-visibility environment

Nice To Haves

Experience with Kubernetes environments and container security
Spectro Cloud (Palette) or similar Kubernetes management platforms
Automation of STIG evaluation and checklist generation
CI/CD pipeline security integration
Elastic / logging / monitoring platforms
Familiarity with: Disconnected or classified environments, IAVM program requirements and reporting, Continuous Monitoring Risk Scoring (CMRS)
Advanced certifications: ACAS Operator and Supervisor Course

Responsibilities

Design, build, and maintain technical solutions that support RMF and ATO artifact generation and validation
Directly support multiple ATO, IATT , and continuous monitoring efforts across the program
Engineer and maintain automated workflows for: Vulnerability data collection (ACAS/Nessus), STIG compliance validation (SCAP, SCC, STIG Viewer, STIG checklists), Artifact generation for eMASS submission
Execute and analyze vulnerability scans using ACAS (Tenable.sc / Nessus) and integrate results into RMF workflows
Perform SCAP and SCC scans in both connected and isolated environments
Develop and maintain STIG checklists and support automated evaluation using tools such as STIG Viewer and Evaluator
Translate scan results into actionable findings, POA&Ms, and risk decisions
Support and maintain eMASS documentation, including: Control implementations, Artifact uploads, Continuous monitoring updates
Build and maintain automation scripts using: Python, Bash, PowerShell
Engineer solutions across: Windows and Linux (RHEL-based systems), Virtual environments (vSphere/ESXi), Containerized platforms (Kubernetes, Spectro Cloud or similar)
Collaborate with IA, ISSOs, system engineers, and developers to: Ensure systems are designed for compliance from the start, Reduce rework during ATO cycles, Support IAVM tracking, vulnerability prioritization, and reporting
Identify opportunities to automate manual RMF processes and improve efficiency across teams
Provide technical input into system architecture reviews from a cybersecurity perspective