Senior Information Systems Engineer (Endpoint Security & C&A)

RIVA Solutions, Inc.

20d•$95,000 - $110,000

About The Position

RIVA is seeking a Senior Information Systems Engineer to provide advanced security engineering, endpoint device management, certification and accreditation (C&A), and federal vulnerability reporting support for an Information Technology Service Desk and Engineering Support program serving the U.S. Department of Health and Human Services. The engineer will design, test, and implement endpoint and network security solutions in accordance with applicable NIST, FISMA, FedRAMP, CISA Binding Operational Directives, and HHS OIG standards. The role includes endpoint engineering, vulnerability reporting, security architecture, C&A processes, and presenting findings and remediation strategies to management. The position supports Government-furnished security services assets and systems, including refreshes and upgrades, and requires regular status reporting. It also involves engineering security solutions, reviewing network configurations and endpoint protections, safeguarding PII, and supporting SIEM log forwarding and audit requirements. The engineer monitors CVE and KEV catalogs, documents vulnerability findings and remediation timelines, tracks compliance deadlines, and prepares technical and executive reports. The engineer provides support for a range of endpoint devices, develops endpoint engineering plans and documentation, conducts integration and security testing, and works with Government staff on technical reviews and recommendations. The role also assists with System Security Plans, Contingency Plans, POA&Ms, and Penetration Test Reports, and collaborates with HHS OIG and internal teams on incidents and escalations. The employee must be able to obtain and maintain a Public Trust clearance and adhere to security and confidentiality protocols.

Requirements

Bachelor’s degree in Information Systems, Computer Science, Engineering, or a related field, or equivalent practical experience.
At least 8 years of experience in IT security engineering, endpoint security, vulnerability management, and C&A processes.
Strong knowledge of federal IT security frameworks, including NIST SP 800 series, FIPS 140-2 and FIPS 201-2, FedRAMP standards, FISMA requirements, and CISA BOD and KEV reporting requirements.
Hands-on experience with vulnerability assessment, CVE/KEV reporting, and remediation tracking.
Experience preparing and presenting security findings and compliance reports to executive management.
Expertise in endpoint engineering and SIEM integration.
Strong documentation and technical writing skills, including C&A documentation.
Must be able to obtain and maintain a Public Trust clearance.
Adhere to security and confidentiality protocols while collaborating directly with Government staff.

Nice To Haves

Advanced degree in Cybersecurity, Engineering, or a related field.
Security certifications such as CISSP, CISM, CISA, CEH, CompTIA Security+, or equivalent.
Experience supporting HHS, DHS, DoD, or other federal agencies in endpoint security and compliance reporting.
Expertise in Zero Trust Architecture, endpoint detection/response, and advanced vulnerability management solutions.
Strong presentation and stakeholder presentation skills.

Responsibilities

Support Government-furnished security services assets and systems, including refreshes and upgrades, and prepare monthly status reports.
Engineer security solutions for hardware, software, and services to protect networks from unauthorized devices, users, and malicious code.
Provide security engineering support in compliance with federal and HHS security mandates, including NIST, DISA STIGs, FedRAMP, and FIPS standards.
Conduct security reviews of network configurations, firewall rules, and endpoint solutions and recommend continuous improvements.
Safeguard Personally Identifiable Information in compliance with NIST SP 800-122.
Provide real-time or near-real-time log forwarding to SIEM systems and support audit requirements.
Monitor and assess CISA-published CVE and Known Exploited Vulnerability catalogs.
Develop, document, and deliver reports on CVE/KEV findings, remediation timelines, and risk ratings.
Track and report compliance with CISA Binding Operational Directives, including mandated remediation deadlines.
Prepare executive summaries and technical reports on vulnerability management activities for leadership.
Present vulnerability, risk, and remediation findings to management and stakeholders in a clear, actionable manner.
Provide engineering support for endpoint devices, including desktops, laptops, thin clients, tablets, mobile phones, and wearables.
Develop technical endpoint engineering plans covering design, scheduling, resources, and monitoring.
Conduct endpoint integration and security testing to ensure compliance with defined requirements and HHS OIG policies.
Develop and maintain endpoint-related SOPs, requirements documentation, and acceptance criteria.
Perform technical reviews with Government staff and present recommendations to improve efficiency and address cybersecurity concerns.
Assist with System Security Plans, Contingency Plans, POA&Ms, and Penetration Test Reports.
Mitigate high-risk vulnerabilities within 30 days and moderate-risk vulnerabilities within 90 days.
Collaborate with HHS OIG and internal technical teams regarding incidents and escalations.