Senior Information Security Engineer

Raventek Solution Partners LLC•Washington, DC

4d•Remote

About The Position

The Senior Information Security Engineer supports the development, implementation, and maintenance of information security standards and configuration baselines to ensure systems meet established security requirements. The role evaluates security configurations, identifies vulnerabilities, and applies industry best practices and federal security guidelines to strengthen system security and compliance. It collaborates with technical teams and stakeholders to deliver secure, reliable, and effective IT solutions. The position is key to RavenTek's performance on the contract and its mission to support the customer. This is a remote, full-time position in the Operations – Services department, reporting to the RavenTek Program Manager. The schedule is Monday through Friday, 40 hours per week. The role is hourly and nonexempt and requires a Public Trust clearance or the ability to obtain and maintain the required Public Trust and/or Suitability/Fitness determination based on client requirements. The employee works indoors in a home office environment, with potential moderate temperature fluctuations, typical indoor and computer-related noise, and typical office, paper, and equipment-related dust. Regular exposure to video display terminals is expected. The position requires extended computer and workstation use, effective verbal and written communication, regular and predictable attendance, and the ability to lift or move moderate amounts of weight, typically up to 20 pounds. RavenTek will make reasonable accommodations in compliance with the Americans with Disabilities Act.

Requirements

High school diploma or GED required.
Minimum of 5 years of experience supporting Information Technology (IT) operations.
Experience creating security baselines using CIS and STIG benchmarks.
Experience working with NIST 800 Special Publication series guidance for risk management and security control implementation, including 800-30, 800-37, 800-53, 800-60, 800-63, 800-115, or 800-137.
Experience reviewing, developing, or customizing general security configuration baselines.
Knowledge of the National Vulnerability Database (NVD) and Common Vulnerability Enumeration (CVE).
Ability to create security baselines from scratch using vendor documentation.
Ability to modify CIS and STIG benchmarks to meet organizational requirements.
Ability to translate low-level security baseline requirements into high-level FISMA and NIST requirements and client-specific security requirements.
Ability to apply practical knowledge of commonly applied information security principles, concepts, and methodologies to resolve well-defined questions or conditions.
Ability to meet deadlines and efficiently plan, prioritize, and accomplish assigned information and industrial security-related tasks.
Analytical skills, including being proactive and flexible, attention to detail, and organizational skills.
Excellent written and spoken communication, presentation, and teamwork skills.
Ability to obtain and maintain a Public Trust and/or Suitability/Fitness determination based on client requirements.

Nice To Haves

Bachelor's degree preferred.
Experience with networking technologies such as Cisco, Juniper, or Palo Alto; operating systems such as Windows Server or Red Hat Linux; cloud services and platforms such as AWS, Azure, Salesforce, Okta, Office 365, or ServiceNow; or mobile technologies such as iOS or XenMobile.
Experience designing, building, and implementing automation tools using Ansible, Chef, or Puppet.
Experience with Infrastructure as Code (IaC) tools, including CloudFormation or Terraform.
Experience with container platforms, including OpenShift.
Experience with chaos engineering and blue-green deployments.
Experience with serverless technologies, including AWS Lambda, API Gateway, Step Functions, and SAM.
Experience with application performance analysis and monitoring tools, including ELK.
Experience with JSON or YAML.
AWS Certified Solutions Architect certification preferred.
AWS Certified Developer certification preferred.
Cisco Certified Network Associate (CCNA) certification preferred.
Microsoft Certified Systems Engineer (MCSE) certification preferred.
Red Hat Certified System Administrator (RHCSA) certification preferred.
EBSA or ECSS certification preferred.

Responsibilities

Develop, review, and maintain security configuration baselines using vendor documentation, CIS benchmarks, and STIGs.
Customize existing CIS and STIG benchmarks to meet organizational and customer-specific security requirements.
Review and assess security configurations to identify vulnerabilities, security weaknesses, and compliance gaps.
Research and analyze identified vulnerabilities using the National Vulnerability Database (NVD) and Common Vulnerabilities and Exposures (CVE).
Translate technical security baseline requirements into applicable FISMA, NIST, and customer-specific security requirements.
Apply NIST 800-series guidance to support risk management, security control implementation, and ongoing security compliance activities.
Develop and maintain technical documentation related to security configuration baselines, standards, and security controls.
Provide technical recommendations to address identified security vulnerabilities and improve system configurations.
Collaborate with technical teams and stakeholders to support implementation of security baselines and compliance requirements.
Enter actual time worked by the end of the day or no later than 10:00 a.m. the following workday, and submit timesheets at the end of each pay period.
Submit status reports regularly as required.
Monitor RavenTek email regularly, at least three times per week, and respond accordingly.
Complete required compliance training as assigned.
Perform other duties as assigned.