Security and Compliance Engineer | Top Secret clearance w/SCI eligibility

American Systems • Arlington, VA

1d • Onsite

About The Position

AMERICAN SYSTEMS is seeking a Security and Compliance Engineer for its Mission Engineering and Integration Team in Arlington, Virginia. The role supports Government and mission teams as they securely integrate data, applications, partners, and internal capabilities across cloud, on-premises, and hybrid environments, including classified and controlled information systems. The engineer translates cybersecurity and compliance requirements into repeatable solutions for authorization, access control, encryption, monitoring, and audit readiness, supporting secure, mission-ready operations and national security objectives.

This requisition is for potential upcoming work and does not represent a current opening. Qualified candidates will be contacted when the work or funding becomes available.

Requirements

• Active Top Secret clearance with SCI and SAP eligibility.
• Bachelor’s degree in cybersecurity, information technology, computer science, engineering, or a related discipline, plus 8 or more years of related experience.
• CompTIA Security+ CE or an equivalent DoD 8140/8570 baseline certification.
• ISC2 CGRC (formerly CAP) or an equivalent Risk Management Framework (RMF) / Assessment and Authorization (A&A) certification.
• Demonstrated knowledge of RMF, ATO support, control mapping, evidence collection, audit readiness, vulnerability management, and risk mitigation.
• Experience supporting data movement, application onboarding, partner access, or enterprise integration across cloud, on-premises, and hybrid environments in classified settings.
• Working knowledge of ABAC concepts, identity attributes, least privilege, PKI, certificates, key management, secrets handling, logging, monitoring, and audit requirements.
• Familiarity with cross-domain solution planning, controlled transfer mechanisms, classification handling, releasability, and multilevel security landing-zone concepts.
• Ability to assess technical changes for security impact, implementation risk, testing requirements, rollback considerations, and documentation updates.
• Ability to coordinate across software, platform, network, data, operations, security, compliance, mission, and Government teams.
• Experience with NIST security controls, vulnerability scanning, STIG compliance, POA&M tracking, and A&A documentation.

Nice To Haves

• Relevant DoD cybersecurity or cloud security certifications, such as ISC2 CISSP or CCSP; ISACA CISM or CISA; GIAC GSEC, GCIH, or GCIA; AWS Certified Security – Specialty; or Azure Security Engineer Associate.
• Experience supporting mission application onboarding or enterprise data integration in Special Access Program (SAP) or SCI environments.
• Experience with eMASS, Xacta, ACAS/Nessus/Tenable, Splunk, STIG Viewer, SCAP, cloud security services, or DevSecOps security tooling.
• Experience preparing compliance evidence for operational readiness reviews, change boards, or authorization milestones.

Responsibilities

• Define cybersecurity, compliance, encryption, identity, audit, logging, and monitoring requirements for data ingestion, application onboarding, partner access, and integration requests.
• Identify classification, information domain, releasability, transfer direction, control mapping, evidence, and approval requirements early in intake to support authorization readiness.
• Develop security artifacts for integration architectures, interface control documents, access control plans, cryptographic protection plans, test plans, readiness packages, and authorization packages.
• Assess integration risks involving least-privilege access, ABAC enforcement, cryptographic protections, monitoring, auditability, and data-handling obligations.
• Coordinate secure implementation with cross-domain, network, cloud, software, data, and operations teams for CDS, diode, RTB-based CDS, API, broker, streaming, and secure-transfer patterns.
• Validate security controls during build, configuration, testing, authorization, production cutover, and sustainment handoff.
• Collect and organize vulnerability results, control implementation statements, test results, configuration records, findings, mitigation plans, and readiness artifacts.
• Monitor compliance posture for control drift, access-policy exceptions, audit gaps, configuration concerns, and risks to approved baselines or mission data flows.
• Advise mission stakeholders on secure integration approaches that maintain mission velocity while meeting Government authorization and compliance obligations.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior