Security Automation / Cyber Security Engineer

Sprezzatura Management Consulting • Remote, US,

3d • $135,000 - $160,000 • Remote

About The Position

Sprezzatura is seeking a Security Automation / Cyber Security Engineer to support cybersecurity modernization for the Department of Veterans Affairs (VA) VA.gov Platform. The role designs, develops, and implements automation to improve how security compliance data is collected, assessed, measured, and reported across a large-scale digital platform. It transforms repeatable manual security and compliance activities into sustainable, engineering-driven capabilities that improve security-posture visibility and reduce the operational burden of maintaining compliance.

Working with security, DevSecOps, infrastructure, and product engineering teams, the engineer focuses on automated evidence collection and control assessment, security data integration, compliance measurement, vulnerability and remediation reporting, Software Bill of Materials (SBOM) capabilities, and security-posture dashboards. The position contributes automation and data capabilities that enable continuous understanding of security requirements, implementation evidence, vulnerabilities, remediation progress, and overall security posture, supporting the Platform Security team's ongoing compliance work.

The position is remote within the United States and is contingent on contract award. Applicants must be U.S. citizens or permanent residents and be able to obtain and maintain the background investigation and access required for VA systems. Standard business hours are Monday through Friday; occasional extended or weekend hours may be required. Reliable internet service is required for telecommuting, and occasional travel may be required. The annual base salary range is $135,000 to $160,000, depending on factors including geographic work location, experience, skills, education, internal equity, security clearance, and contract requirements.

Requirements

• Associate's degree and four years of relevant experience, or a bachelor's degree and two years of relevant experience; alternatively, five years of experience as a Cyber Security Engineer may substitute for a degree.
• Experience developing automation using Python, JavaScript, or another scripting or programming language.
• Experience integrating data from APIs, cloud platforms, CI/CD systems, security tools, or other technical systems.
• Experience designing or developing automated workflows, data pipelines, dashboards, metrics, or reporting solutions.
• Working knowledge of cybersecurity concepts, including security controls, vulnerability management, continuous monitoring, and compliance.
• Experience with modern software development and CI/CD practices.
• Ability to analyze security and technical data and translate it into meaningful metrics and actionable information.
• Strong written and verbal communication skills and ability to collaborate across security, engineering, product, and program teams.
• Ability to obtain and maintain the background investigation and access required to support Department of Veterans Affairs systems.
• U.S. citizenship or permanent residency is required.

Nice To Haves

• Experience supporting federal cybersecurity programs or systems operating under the NIST Risk Management Framework (RMF).
• Knowledge of NIST SP 800-53 Rev. 5 security controls.
• Experience with OSCAL or other machine-readable approaches to security compliance and control assessment.
• Experience automating security evidence collection, continuous monitoring, or compliance assessment.
• Experience with AWS security and configuration data, including AWS Security Hub, GuardDuty, or similar cloud-native security tooling.
• Experience integrating security capabilities into or extracting security data from GitHub Actions or other CI/CD platforms.
• Experience with SAST, DAST, Software Composition Analysis (SCA), secrets detection, container scanning, or other application security tooling.
• Experience implementing or working with SBOM standards and tooling.
• Experience with software supply-chain security and dependency or third-party component risk analysis.
• Experience developing security posture, vulnerability management, or compliance dashboards.
• Familiarity with federal ATO processes, POA&Ms, control implementation evidence, and independent controls assessments.
• Experience working within large-scale cloud platforms or environments supporting multiple independent product and engineering teams.

Responsibilities

• Design, develop, and maintain automated processes for collecting security and compliance evidence from authoritative system, infrastructure, configuration, and security data sources.
• Develop automation supporting security control assessment and continuous monitoring, including OSCAL-based evidence collection and control-assessment capabilities.
• Build integrations and data pipelines to aggregate and normalize security information from multiple tools, platforms, and APIs.
• Develop security metrics and dashboards providing near-real-time visibility into control posture, remediation status, vulnerabilities, and other security indicators.
• Automate recurring security and compliance reporting for security teams, engineering teams, program leadership, and government stakeholders.
• Develop capabilities to measure security-control and security-tooling coverage across applications, infrastructure, and CI/CD pipelines.
• Automate vulnerability and remediation reporting to support prioritization, ownership, aging analysis, and tracking through closure.
• Support implementation and operation of an SBOM capability, including collection and analysis of software dependency and third-party component data.
• Integrate SBOM and software supply-chain information with vulnerability management and security reporting capabilities.
• Partner with DevSecOps Engineers to ensure security controls in CI/CD pipelines and infrastructure generate usable, repeatable compliance evidence.
• Identify manual security and compliance processes suitable for automation and implement scalable solutions where feasible.
• Support repeatable processes that enable product and engineering teams to demonstrate continued compliance with defined security standards.
• Ensure automated security evidence, metrics, and reporting are traceable, maintainable, and usable for ongoing compliance activities and independent controls assessments.
• Document automation, integrations, data sources, processes, and technical solutions to support long-term sustainment by the Platform Security team.
• Collaborate with security engineers, cybersecurity/RMF specialists, DevSecOps engineers, software engineers, product teams, and government stakeholders.

Benefits

• Medical, dental, and vision coverage.
• Health Savings Account (when enrolled in an eligible plan), with a company contribution.
• Company-paid life, accidental death, short-term disability, and long-term disability coverage.
• Voluntary accident, hospital indemnity, and critical care insurance.
• Voluntary medical and dependent care Flexible Spending Accounts.
• Accrued paid time off and company-paid holidays.
• 401(k) retirement plan with company match.

What This Job Offers

• Job Type: Full-time
• Education Level: Associate degree