Sr. ISSE TS/SCI Polygraph

Leidos•Annapolis Junction, MD

About The Position

Leidos is hiring a Senior Information System Security Engineer in its Intel Sector's Cyber & Analytics Business Area to support a complex national security program. The role is part of a high-performing agile team using the Scaled Agile Framework (SAFe), with program execution following DevOps practices and supporting development, test, integration, production, and operational environments. The team enhances system security architecture and cybersecurity capabilities, manages system security plans under the Risk Management Framework (RMF), manages cross-domain capabilities, and supports Security Verification Testing of relevant Type 1 devices. The engineer will help add technology and capabilities to an ongoing operational system with demanding interface, performance, and security requirements. The position calls for sound knowledge of security practices and policies, hands-on vulnerability testing, and collaboration with program, customer, system engineering, test engineering, integration, and development teams. An active TS/SCI Polygraph is required before starting; the posting states that exceptions will not be made.

Requirements

Bachelor's degree and 12–15 years of prior relevant experience.
Active TS/SCI Polygraph required up front; the posting states no exceptions.
Solid understanding of security practices and policies, with hands-on vulnerability testing experience using customer tools.
Experience applying the Risk Management Framework.
Experience formulating and assessing IT security policy.
Demonstrated knowledge of common security tools, such as Nessus, NMAP, and Wireshark.
Knowledge of hardware and software security implementation, communication protocols, encryption techniques and tools, and web services.
Experience with secure configurations of commonly used desktop and server operating systems.

Nice To Haves

Experience with Defense in Depth principles and technologies, including access control, authorization, identification and authentication, public key infrastructure, and network and enterprise security architecture, and with applying risk assessment methodology to system development.
DoD 8570 compliance with IASAE Level 2 or 3.
Information Systems Security Engineering Professional (ISSEP) certification.
Computer Information Systems Security Professional (CISSP) certification.
Experience developing or implementing integrated security services management processes, including network penetration testing assessment and auditing, antivirus planning assistance, risk analysis, and incident response.
Experience providing information assurance support for application development, including system security certifications and project evaluations for firewalls involving development, design, and implementation.
Experience with penetration testing tools.
Experience with scripting languages.

Responsibilities

Validate and verify system security requirements and establish security designs for large-scale systems, major system elements, and interfacing systems in complex, geographically distributed networks.
Identify and implement information security architectures and functionality that support consistent security policy and enterprise solutions.
Recommend and develop technical solutions, products, and standards based on system security architecture needs.
Assess and mitigate system security threats and risks throughout the program life cycle.
Lead or contribute to security planning, assessment, risk analysis and management, certification, and awareness activities for system and network operations.
Collaborate with internal technical experts and communicate significant security matters to program managers and customer points of contact as needed.
Participate in Program Increment Planning and related agile team activities.
Work with System Engineering, Test Engineering, and Integration teams to ensure hardware and software architecture and implementation meet security requirements.
Assess system implementation against security compliance policies and recommend and implement improvements.
Evaluate security solutions against customer requirements for information processing, and assess how new development affects the system's operational security posture.
Evaluate, review, and test critical software.
Propose, assess, coordinate, implement, and enforce information systems security policies, standards, and methodologies.
Audit and assess system security configuration settings using common methodologies and tools.
Manage and enforce security strategies and policies across geographically distributed system components.
Provide configuration management for security-relevant information system software.
Serve as a security architecture subject matter expert and advise program managers, customer technical experts, and internal program teams.
Formulate security compliance requirements for new system features and identify and remediate system security issues.
Support risk assessment, risk management, security control assessment, continuous monitoring, service design, and other information assurance program functions.
Work with development teams to improve understanding of vulnerabilities, attack vectors, and remediation approaches.
Plan and conduct security verification testing of relevant Type 1 devices.