Product Security Engineering 2

The Structures Company•Colorado Springs, CO

2d•Onsite

About The Position

Partners with Cyber Engineering organization to embed and validate cybersecurity solutions on the C2BMC platform, ensuring all security controls are correctly implemented and fully tested. Serves as primary liaison with the Cyber Test Facility (CTF) at MIDOC, coordinating test events and validating test plans submitted by cyber teams. Briefs program leadership on test plan analysis and assists teams in identifying specific cyber requirements for successful execution. Supports cyber teams by facilitating timely delivery of capabilities and solutions with a strong focus on vulnerability management. Performs end-to-end handling of Information Assurance Vulnerability Management (IAVM) tickets, Cyber Tasking Orders (CTO), and Common Vulnerabilities and Exposures (CVE) remediation. Integrates vendor-issued patches and applies and verifies DISA STIG configurations. Applies strong working knowledge of cyber capabilities including patch management, multi-factor authentication, host-based security, intrusion detection, security event management, active/passive system scanning, and defense-in-depth. Performs hands-on work throughout the Agile development lifecycle using the Scrum framework, including requirements identification, user story definition, and participation in sprint planning, daily stand-ups, and sprint reviews. Reviews test plans and test cases supplied by development teams, verifies correct implementation, executes tests, and provides actionable feedback to ensure compliance with cyber security requirements. Configures cyber audit tools, performs cyber vulnerability assessments, and handles configuration activities.

Requirements

Active DoD Secret security clearance required at start.
Must be a U.S. Person (as defined by ITAR).
Education/experience typically acquired through advanced education (e.g. Associate) and typically 1 or more years' related work experience or an equivalent combination of education and experience (e.g. Bachelor, 3 years' related work experience, etc.).
DoD 8140 IAT-Level II certification (e.g., Security+ or higher) required at start.
Generally 3+ years of related experience.
Strong working knowledge of core cyber capabilities including patch management, Group Policy Object (GPO) management, and proven remediation techniques for cybersecurity vulnerabilities and threats.
Security-engineering expertise in Information Assurance (IA) technologies, NIST standards, DoDI8500.2, and Risk Management Framework (RMF) security controls.
Experience throughout the Agile development lifecycle using the Scrum framework.
Experience configuring cyber audit tools and performing cyber vulnerability assessments.
Solid understanding of Software Development Life Cycle (SDLC) models and testing processes.
Proficiency in cyber-tool software applications.

Responsibilities

Embed and validate cybersecurity solutions on the C2BMC platform.
Ensure all security controls are correctly implemented and fully tested.
Serve as primary liaison with the Cyber Test Facility (CTF) at MIDOC.
Coordinate test events and validate test plans submitted by cyber teams.
Brief program leadership on test plan analysis.
Assist teams in identifying specific cyber requirements for successful execution.
Facilitate timely delivery of capabilities and solutions with a strong focus on vulnerability management.
Perform end-to-end handling of Information Assurance Vulnerability Management (IAVM) tickets, Cyber Tasking Orders (CTO), and Common Vulnerabilities and Exposures (CVE) remediation.
Integrate vendor-issued patches.
Apply and verify DISA STIG configurations.
Perform hands-on work throughout the Agile development lifecycle using the Scrum framework.
Review test plans and test cases supplied by development teams.
Verify correct implementation of security controls.
Execute tests and provide actionable feedback to ensure compliance with cyber security requirements.
Configure cyber audit tools.
Perform cyber vulnerability assessments.
Handle configuration activities.