Security Engineer

ASM Research•Remote,

1d•Onsite

About The Position

The Security Engineer will support the security posture of the CMS Health Insurance Oversight System (HIOS) Platform Team, working within a complex federal production environment. This individual will safeguard cloud infrastructure and sensitive data by designing, implementing, and maintaining robust security solutions, playing a crucial role in identifying and mitigating security risks, automating security processes, and ensuring compliance with industry best practices and regulatory requirements. The Security Engineer will work as part of a cross-functional Agile team.

Requirements

Bachelor’s Degree
At least four years of relevant experience across compliance, identity, networking, system data, and cloud security, along with experience researching security issues and assisting in creating new security technology solutions, and experience evaluating overall risk using monitoring systems and tools (custom, Splunk, New Relic, firewall, system, application, native CSP, SIEM, and vulnerability scans).

Nice To Haves

Monitoring solutions (Splunk, New Relic, etc.)
Scripting
Zero Trust Architecture
AWS/Azure
Security Remediation
PKI and API Key Management
Threat Modeling
Certificates Management
Okta
Kali Linux
Red Teaming
Hack-the-Box
Capture-the-Flag
Pen Testing
MITRE ATT&CK Framework
Strong understanding of cloud security principles and best practices.
CISSP, CCSP, CompTIA Security+, Cloud Security certificate (any CSP), CISA, CCNA, or other security/network certifications

Responsibilities

Research security issues and assist in creating new security technology solutions.
Design and develop scripts to automate security control workflow lifecycle.
Evaluate overall risk by utilizing and enhancing monitoring systems and tools (custom, Splunk, New Relic, firewall, system, application, native CSP, SIEM, and vulnerability scans).
Participate in the development and implementation of information security operational and strategic procedures, adhering to industry best practices and compliance requirements.
Execute large client data classification and security assessments.
Develop and enforce policies for secure API key generation, storage, and rotation.
Manage remediation plans in support of risk assessment goals.
Conduct threat modeling exercises to identify potential security risks and vulnerabilities.
Follow CMS security, accessibility, documentation, configuration management, and software development lifecycle requirements.
Provide technical guidance and security knowledge sharing to other team members as appropriate.