ISSM / Security Automation Engineer

Quantum Sky•Remote,

5d•$175,000 - $190,000

About The Position

Quantum Sky is searching for a highly technical Information System Security Manager (ISSM) / Security Automation Engineer to lead cybersecurity risk management and security authorization activities while designing and developing automation that enables continuous security and compliance. This is a hands-on engineering role for an individual who can operate effectively across cybersecurity governance, cloud security, DevSecOps, software automation, and NIST Risk Management Framework (RMF) environments. The successful candidate will own traditional ISSM responsibilities while also developing scripts, integrations, and automated workflows that reduce manual compliance activities and provide continuous visibility into system security posture. The ideal candidate has previous software development or automation engineering experience and is comfortable working directly with source code, APIs, cloud services, CI/CD pipelines, Infrastructure as Code, security tooling, and machine-readable compliance data. The objective of this position is to move security programs away from periodic, document-driven compliance toward automated, continuous security assurance and Compliance as Code.

Requirements

Bachelor’s degree in Cybersecurity, Computer Science, Information Technology, Software Engineering, or a related field, or equivalent professional experience.
Demonstrated experience as an ISSM, ISSO, Security Engineer, Cloud Security Engineer, DevSecOps Engineer, or similar technical cybersecurity professional.
Strong knowledge of NIST SP 800-53, NIST SP 800-37, RMF, security authorization, security control assessment, and continuous monitoring.
Demonstrated hands-on experience developing production-quality automation, scripts, integrations, or software.
Strong programming or scripting experience with Python and experience with one or more additional languages or scripting environments such as PowerShell, Bash, JavaScript, or Go.
Experience working with JSON and YAML.
Experience automating cybersecurity, infrastructure, compliance, or operational processes.
Experience with vulnerability scanning and vulnerability management technologies.
Experience with cloud platforms such as AWS, Azure or GCP.
Ability to understand cloud and enterprise system architectures and evaluate their security implications.
Ability to translate regulatory and cybersecurity requirements into technical engineering requirements.

Nice To Haves

Experience developing automation against AWS, Azure or GCP API/SDKs
Experience with Infrastructure as Code technologies such as Terraform.
Experience with configuration management and automation technologies such as Ansible.
Experience with CI/CD platforms such as GitHub Actions, GitLab CI/CD, Jenkins, or Azure DevOps.
Experience with container and orchestration technologies such as Docker and Kubernetes.
Experience integrating vulnerability scanners, SIEM platforms, CSPM/CNAPP solutions, GRC platforms, and ticketing systems.
Experience developing security dashboards and data pipelines.
Experience with automated testing frameworks and software engineering practices.
Experience with serverless architectures and event-driven automation.
Experience transforming NIST controls and security documentation into structured, machine-readable data.
Experience with Compliance as Code and Policy as Code technologies such as Open Policy Agent (OPA).
Experience implementing automated security evidence collection and continuous control validation.
Experience supporting FISMA, FedRAMP, DoD RMF, CMMC, or other federal cybersecurity programs.
Experience supporting systems through initial authorization and ongoing authorization processes.
Experience working with Security Control Assessors (SCAs), Third Party Assessment Organizations (3PAOs), or government Authorizing Officials.
Experience developing or maintaining SSPs, POA&Ms, Security Assessment Reports, continuous monitoring documentation, and supporting authorization artifacts.
Familiarity with federal security baselines, implementation guidance, and security assessment procedures.
One or more of the following is preferred: CISSP, CGRC, CISM, CCSP, Security+ AWS Solution Architect or Security Specialty GCP Cloud Architect or Security Engineer Certified Kubernetes Security Specialist (CKS)

Responsibilities

Lead RMF, Security Authorization & Continuous Assurance — Own NIST RMF implementation, system authorization and ongoing authorization activities, including SSPs, control implementation documentation, risk assessments, continuous monitoring artifacts, and coordination with system owners, assessors, ISSOs, engineers, and Authorizing Officials.
Engineer Security & Compliance Automation — Design, develop, and maintain production-quality automation using Python, PowerShell, Bash, APIs, and cloud-native technologies to automate control validation, evidence collection, compliance reporting, security assessments, and remediation workflows.
Implement Compliance as Code & Continuous Control Monitoring — Translate NIST SP 800-53 controls and organizational requirements into measurable technical requirements, machine-readable policies, automated validation procedures, and continuous control monitoring capabilities.
Embed Security into Cloud & DevSecOps Workflows — Partner with engineering and platform teams to integrate security into cloud architectures, Infrastructure as Code, CI/CD pipelines, containers, Kubernetes, and software delivery processes, including automated testing, policy validation, and security gates.
Integrate Security Platforms, Data & Tooling — Build integrations and reusable services connecting cloud platforms, vulnerability scanners, security tools, GRC platforms, ticketing systems, source-code repositories, and CI/CD systems using APIs and structured data such as JSON and YAML.
Manage Vulnerabilities, Findings & Cybersecurity Risk — Automate vulnerability and configuration finding ingestion, correlation, prioritization, assignment, tracking, and reporting; manage POA&Ms, exceptions, and remediation through closure; and evaluate system architectures and changes for cybersecurity risk.
Deliver Continuous Security Visibility & Improvement — Develop dashboards, metrics, and automated reporting that provide actionable visibility into vulnerabilities, configuration compliance, control status, POA&Ms, and organizational risk while identifying opportunities to replace manual security reviews with automated technical validation.