Security Engineer

Bixal•Fairfax, VA

1d•$130,000 - $140,000•Remote

About The Position

Bixal is seeking a Security Engineer to serve as the security lead for a FIPS 199 Moderate federal platform supporting governmentwide regulatory planning and review. The systems must remain available 24/7/365 while a modern replacement is developed alongside them. The engineer will secure both the existing Java, Oracle, and Red Hat environment and a new cloud-based platform, helping prepare the latter for an Authority to Operate (ATO) before production deployment. This is a client-facing role. The Security Engineer will be the program’s named security lead, partnering with client technical leads, the Project Manager, and the engineering team to turn security requirements into practical decisions that support delivery. The role is full-time on an awarded contract with a 12-month base period and two 12-month option periods. It is remote from anywhere in the USA. Applicants must be legally authorized to work in the US; Bixal does not provide visa sponsorship. The role requires the ability to obtain and maintain a favorable Public Trust determination. The salary range is $130,000–$140,000, with most offers tending near the midpoint. Compensation decisions consider experience, skills, and internal equity. The position offers a fixed contract duration, with Bixal communicating contract updates and potential opportunities transparently.

Requirements

Bachelor’s degree in Cybersecurity, Computer Science, Information Systems, or a related field.
At least 5 years of hands-on information security experience, including securing federal information systems under FISMA.
Hands-on experience with the NIST Risk Management Framework, including implementing and assessing NIST SP 800-53 Rev. 5 controls at the Moderate baseline.
Experience writing and maintaining A&A documentation, including System Security Plans, contingency plans, incident response plans, and POA&Ms, and supporting a system through ATO.
Experience running vulnerability scanning tools such as Tenable/Nessus or Qualys and driving remediation across operating system, database, and web application layers.
Experience hardening Linux servers, preferably Red Hat Enterprise Linux, and relational databases, preferably Oracle, against CIS or agency benchmarks.
Working knowledge of application security, including the OWASP Top 10 and ASVS, static and dynamic testing tools, and securing CI/CD pipelines.
Familiarity with public key infrastructure, TLS certificate management, firewall configuration, and network protocols.
Clear, confident communication skills, including the ability to explain risk and trade-offs to technical and non-technical stakeholders and client leadership.
Ability to obtain and maintain a favorable Public Trust determination in support of a federal government contract.
Must be legally authorized to work in the United States; visa sponsorship is not provided.

Nice To Haves

Security certifications such as CISSP, CISM, CompTIA Security+, or equivalent.
Experience with GSA IT security policies, procedural guides, or the GSA ATO process.
Experience securing cloud-hosted or containerized platforms, such as AWS, cloud.gov, Docker, or Kubernetes.
Familiarity with Zero Trust architecture (OMB M-22-09) and secure software development practices (NIST SSDF, OMB M-22-18).
Experience with identity federation and single sign-on, including Login.gov.
Experience with monitoring and logging tools such as Grafana, Prometheus, Loki, or Splunk.
Experience supporting systems through a legacy-to-modern platform migration.

Responsibilities

Run automated vulnerability scans of operating systems, databases, and web applications, and lead remediation and patching across Red Hat Enterprise Linux, Oracle, Apache/Tomcat, and Java application components.
Meet contractual remediation timelines for scan and penetration-test findings (15 days for critical, 30 for high, 60 for medium, and 120 for low), and document Plans of Action and Milestones (POA&Ms) when timelines cannot be met.
Harden systems against GSA security benchmarks and CIS Level 1 guidelines.
Track end-of-life software, unsupported libraries, and known vulnerabilities, and raise risks early with a recommended path forward.
Support continuous monitoring, log review, and incident response in line with NIST SP 800-61.
Support continuity of operations (COOP) and disaster recovery planning and testing.
Maintain the system’s assessment and authorization package under NIST SP 800-37 and SP 800-53 Rev. 5, including the System Security and Privacy Plan, contingency plan, business impact analysis, incident response plan, and contingency plan test report.
Maintain POA&Ms and support Government-led security assessments, control reviews, and penetration testing.
Support privacy compliance artifacts such as Privacy Threshold Assessments and Privacy Impact Assessments.
Keep security documentation current as legacy capabilities are replaced and retired.
Perform threat modeling for new features, integrations, and architecture decisions.
Embed static and dynamic security testing, such as Snyk and OWASP ZAP, in CI/CD pipelines so every release meets OWASP ASVS with no unresolved medium or high findings.
Review releases for security impact before production, protecting availability.
Advise on secure architecture for the modernized platform, including federated identity, FIPS 140-validated encryption, Zero Trust principles, and software supply chain security.
Prepare security packages for prototype testing and position the new platform to receive an ATO at production deployment.
Provide guidance on public key infrastructure, firewall and network security, internet protocols, and configuration management.
Serve as the client’s security point of contact, briefing technical leads and the Project Manager on risks, findings, and remediation progress.
Coordinate with client IT teams on infrastructure changes and validate system security after those changes.
Perform other relevant duties as assigned and qualified or trained to perform.