Senior ISSE TS/SCI Polygraph

Leidos•Annapolis Junction, MD

About The Position

Leidos is hiring a Senior Information System Security Engineer in its Intel Sector’s Cyber & Analytics Business Area to support a fast-paced, complex national security program. The team uses the Scaled Agile Framework (SAFe) and DevOps practices across development, test, integration, production, and operational environments. The contract supports system engineering, development, testing, integration, and operations, with a focus on adding new technology and advanced capabilities while sustaining an operational system. The role requires an active TS/SCI Polygraph at the time of application. The engineer will work with a team improving operational, test, integration, and development systems. Responsibilities span security architecture, Risk Management Framework (RMF) activities, vulnerability testing, security compliance, risk management, configuration management, and security verification testing of relevant Type 1 devices. The position requires hands-on security engineering experience and collaboration with system engineering, test, integration, development, program management, and customer teams.

Requirements

Active TS/SCI Polygraph required up front.
Bachelor’s degree and 12 years of relevant experience.
Solid understanding of security practices and policies, plus hands-on vulnerability testing experience using customer tools.
Experience applying the Risk Management Framework.
Experience formulating and assessing IT security policy.
Knowledge of and experience with common security tools, such as Nessus, NMAP, and Wireshark.
Knowledge of hardware and software security implementation, communication protocols, encryption techniques and tools, and web services.
Experience securely configuring commonly used desktop and server operating systems.
Ability to work on multiple systems and components simultaneously in various configurations.
Strong verbal and written communication skills.
Commitment to adopting and adhering to best practices.
Ability to plan and prioritize tasks and communicate technical options and trade-offs clearly.
Ability to produce high-quality work independently and as part of a team in a fast-moving environment.

Nice To Haves

Five years of experience with Defense in Depth principles and technologies, including access control, authorization, identification and authentication, public key infrastructure, and network and enterprise security architecture, as well as applying risk assessment methodology to system development.
DoD 8570 compliance with IASAE Level 2 or 3.
Information Systems Security Engineering Professional (ISSEP) certification.
Computer Information Systems Security Professional (CISSP) certification.
Experience developing or implementing integrated security services management processes, such as network penetration testing assessment and auditing, antivirus planning assistance, risk analysis, and incident response.
Experience providing information assurance support for application development, including system security certifications and project evaluations for firewalls spanning development, design, and implementation.
Experience with penetration testing tools.
Experience with scripting languages.

Responsibilities

Validate and verify system security requirements and establish security designs for large-scale systems, system elements, and interfacing systems in complex, geographically distributed network environments.
Identify and implement information security architectures and functionality that support consistent security policy application and enterprise solutions.
Recommend and develop technical solutions, products, and standards based on current and desired system security architecture.
Assess and mitigate system security threats and risks throughout the program life cycle.
Lead or contribute to security planning, assessment, risk analysis and management, certification, and awareness activities for systems and network operations.
Collaborate with internal technical experts and communicate significant security issues to Program Managers and customer organization points of contact as needed.
Participate in Program Increment Planning and other agile team activities.
Work with System Engineering, Test Engineering, and Integration teams to ensure hardware and software architecture and implementation meet security requirements.
Assess system implementations against security compliance policies and recommend and implement enhancements.
Evaluate security solutions against customer requirements for information processing and assess the effects of new development on operational security posture.
Evaluate, review, and test critical software.
Propose, assess, coordinate, implement, and enforce information systems security policies, standards, and methodologies.
Audit and assess system security configuration settings using common methodologies and tools.
Manage and enforce security strategies and policies across components of geographically distributed systems.
Provide configuration management for security-relevant information system software.
Serve as a security architecture subject matter expert and advise Program Managers, customer technical experts, and internal program teams.
Formulate security compliance requirements for new system features and identify and remediate security issues throughout the system.
Support risk assessment and management, security control assessment, continuous monitoring, service design, and other information assurance program functions.
Work with development teams to improve team understanding of vulnerabilities, attack vectors, and remediation approaches.
Plan and conduct security verification testing of relevant Type 1 devices.