Security and Compliance Engineer | Top Secret clearance w/SCI eligibility

AMERICAN SYSTEMS • Arlington, VA

1d

About The Position

AMERICAN SYSTEMS is seeking a Security and Compliance Engineer for its Mission Engineering and Integration Team in Arlington, Virginia. The role supports Government and mission teams in securely integrating data, applications, partners, and internal capabilities across cloud, on-premises, and hybrid environments, including classified and controlled information systems. The engineer translates cybersecurity and compliance requirements into repeatable solutions supporting authorization, access control, encryption, monitoring, and audit readiness.

This requisition is for potential upcoming work and is not a current opening. Qualified candidates will be contacted when the work and funding become available.

Requirements

• Active Top Secret clearance with SCI and SAP eligibility.
• Bachelor’s degree in cybersecurity, information technology, computer science, engineering, or a related discipline, plus 8+ years of related experience.
• CompTIA Security+ CE or an equivalent DoD 8140/8570 baseline certification.
• ISC2 CGRC (formerly CAP) or an equivalent Risk Management Framework (RMF) / Assessment and Authorization (A&A) certification.
• Demonstrated knowledge of RMF, ATO support, control mapping, evidence collection, audit readiness, vulnerability management, and risk mitigation.
• Experience supporting data movement, application onboarding, partner access, or enterprise integration across cloud, on-premises, and hybrid environments in classified settings.
• Working knowledge of ABAC concepts, identity attributes, least privilege, PKI, certificates, key management, secrets handling, logging, monitoring, and audit requirements.
• Familiarity with cross-domain solution planning, controlled transfer mechanisms, classification handling, releasability, and multilevel security landing-zone concepts.
• Ability to assess technical changes for security impact, implementation risk, testing requirements, rollback considerations, and documentation updates.
• Ability to coordinate across software, platform, network, data, operations, security, compliance, mission, and Government teams.
• Experience with NIST security controls, vulnerability scanning, STIG compliance, POA&M tracking, and A&A documentation.

Nice To Haves

• Relevant DoD cybersecurity or cloud security certifications, including ISC2 CISSP or CCSP; ISACA CISM or CISA; GIAC GSEC, GCIH, or GCIA; AWS Certified Security – Specialty; or Azure Security Engineer Associate.
• Experience supporting mission application onboarding or enterprise data integration in Special Access Program (SAP) or SCI environments.
• Experience with eMASS, Xacta, ACAS/Nessus/Tenable, Splunk, STIG Viewer, SCAP, cloud security services, or DevSecOps security tooling.
• Experience preparing compliance evidence for operational readiness reviews, change boards, or authorization milestones.

Responsibilities

• Define cybersecurity, compliance, encryption, identity, audit, logging, and monitoring requirements for data ingest, application onboarding, partner access, and IPT integration requests.
• Drive authorization readiness by identifying classification, information domain, releasability, transfer direction, control mapping, evidence, and approval requirements early in the intake process.
• Develop security artifacts for integration architectures, interface control documents, access control plans, cryptographic protection plans, test plans, readiness packages, and authorization packages.
• Assess integration risk across least-privilege access, ABAC enforcement, cryptographic protections, monitoring needs, auditability, and data-handling obligations.
• Coordinate secure implementation with cross-domain, network, cloud, software, data, and operations teams for CDS, diode, RTB-based CDS, API, broker, streaming, and secure-transfer patterns.
• Validate security controls during build, configuration, testing, authorization, production cutover, and sustainment handoff.
• Collect and organize evidence, including vulnerability results, control implementation statements, test results, configuration records, findings, mitigation plans, and readiness artifacts.
• Monitor compliance posture for control drift, access-policy exceptions, audit gaps, configuration concerns, and risks to approved baselines or mission data flows.
• Advise mission stakeholders on secure integration approaches that preserve mission velocity while meeting Government authorization and compliance obligations.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior