Sr. Cybersecurity Integration Engineer (USI9)

VSE AVIATION•Miramar, FL

52d•Remote

About The Position

VSE Aviation is building a dedicated IT Integration Team. The Senior Cybersecurity Integration Engineer brings acquired sites up to VSE security standards, from post-closure activities through architecture buildout and handoff to steady-state operations. This is a senior individual-contributor role requiring independent execution. Working with IT Technology Services Integration Specialists, the engineer leads security work covering firewall and network architecture, identity and Zero Trust, endpoint security, email protection, and SIEM onboarding. The primary focus is network security, including perimeter design, firewall deployment, and segmentation at newly acquired sites whose existing environments may be unfamiliar or incompletely documented. The engineer designs within VSE standards and tooling, presents proposed changes to the cybersecurity team, and partners with security operations through implementation so sites reach steady-state monitoring without business disruption. This is a remote-based, field-oriented role involving sustained periods on-site at domestic and international acquisition locations. Travel may reach 75% during active integration cycles. Overnight, weekend, after-hours, and on-call coverage may be needed during go-live, cutover, and hyper-care periods. The role also involves lifting and racking network and security hardware up to 40 pounds and working in data closets, MDF/IDF spaces, and warehouse environments.

Requirements

Bachelor’s degree in information technology, cybersecurity, or a related field, or an additional three years of specific work experience in lieu of a degree.
Seven years of firsthand network security engineering experience in a multi-site enterprise environment, including at least three years at a senior or lead level.
Ability to own security architecture end to end—from assessment and design through build, validation, documentation, and handoff—while following defined standards and without a senior engineer above them.
Deep, demonstrable enterprise firewall experience, including physical deployment, rule-set design and cleanup, NAT, site-to-site and remote-access VPN, and inspection policy on a major NGFW platform.
Ability to describe firewall deployments personally designed and built.
Proven network segmentation design experience, including segmenting networks the candidate did not build and that lack complete documentation.
Strong routing and switching fundamentals, including VLANs, dynamic routing protocols, and ACLs.
Practical experience migrating production firewalls and VPN appliances from legacy platforms without causing a business outage.
Ability to assess an unfamiliar environment and develop a migration plan that brings it to standard, including compensating controls for business-critical systems that must remain accessible.
Working expertise in Microsoft 365 and Entra ID security, including Conditional Access, MFA, and identity protection.
Practical experience deploying and operating an EDR platform at scale.
Track record of building to an established enterprise security standard and improving it within a team.
Comfort operating independently in the field while staying closely connected to an in-house security team.
Willingness and ability to travel up to 75% to acquisition sites, including occasional short-notice travel.
Ability to lift and rack network and security hardware up to 40 pounds and work in data closets, MDF/IDF spaces, and warehouse environments.
Ability to meet customer- or contract-driven background-screening requirements; selected applicants are subject to a background check and drug testing.

Nice To Haves

Prior experience as technical lead on M&A technology integration, carve-outs, or divestitures.
Experience presenting security risk findings to executives or acquiring-company leadership.
Vendor firewall certification (Palo Alto, Fortinet, or Cisco) or an industry certification such as CISSP or GIAC (GSEC, GCIH, or GCIA).
Experience in aviation, aerospace, defense, or another regulated manufacturing or MRO environment.
Familiarity with NIST CSF, NIST SP 800-171, or CMMC control expectations.
Experience securing warehouses, shop floors, or OT-adjacent environments with low downtime tolerance.
Scripting, automation, or AI-assisted tooling experience, such as PowerShell or Python, to accelerate onboarding and validation at scale.

Responsibilities

Execute the day-one security onboarding checklist for acquired-site personnel and systems.
Assess and document an acquired entity’s security posture, including vulnerabilities, unmanaged assets, privileged accounts, and control gaps, and prepare a written risk summary for IT and business leadership.
Conduct initial network reconnaissance and perimeter reviews, including inbound exposure, remote access paths, and third-party connections.
Escalate indicators of active or historical compromise, proposed risk acceptances, deviations from VSE security standards, and unplanned spending to cybersecurity leadership.
Lead physical and logical deployment of perimeter firewalls at integration sites.
Configure firewall rule sets, site-to-site and remote-access VPNs, and inspection policies according to VSE standards.
Validate firewall posture through policy reviews, traffic analysis, and post-deployment testing.
Coordinate with Infrastructure on network segmentation design and firewall placement relative to LAN, wireless, and OT/warehouse systems.
Decommission or isolate legacy perimeter devices and third-party remote access after cutover.
Implement Zero Trust Network Access controls and enforce least privilege across user roles, systems, and applications.
Configure Conditional Access policies, device-compliance requirements, and application-access controls in Microsoft Entra ID.
Enforce User Assignment Required on enterprise applications and remediate legacy authentication.
Configure and validate MFA and identity protection for user, service, and privileged accounts.
Validate Zero Trust posture through access reviews, policy testing, and monitoring dashboards.
Work with acquired-company IT contacts to deploy and configure EDR across acquired-site devices and servers, confirming coverage against the asset inventory.
Onboard acquired sites to VSE’s SIEM platform and ensure log-source ingestion health and alerting coverage.
Implement email-security tooling aligned with VSE standards, including anti-phishing, secure email gateway, and DLP policies.
Verify that security telemetry is monitored and alerts are routed correctly before declaring an integration complete.
Coordinate with vendors to order security hardware, including firewalls and endpoint sensors.
Manage security-tooling vendor relationships, licensing, and support escalations.
Manage security-application license allocations and ensure compliance with vendor agreements.
Track hardware delivery, inventory, and deployment readiness against integration schedules.
Maintain per-site integration documentation, including architecture diagrams, rule sets, exceptions, and residual risks.
Produce formal security handoff packages for transition to steady-state IT and security operations.
Track and drive closure of open security findings and accepted-risk items after cutover.
Report integration milestones, blockers, and cross-team dependencies in integration stand-ups and the shared IT Integration project workspace.
Serve as the cybersecurity contributor in PMO-led integration closeouts, presenting security outcomes, residual risks, and unresolved findings.
Maintain and improve VSE’s cybersecurity integration playbook and supporting documentation, incorporating lessons learned into standards, checklists, and effort estimates for future integrations.
Perform other duties as assigned.