IT Security EngineerThis role requires expertise in application security, cloud security (Azure/Microsoft 365), and NIST

IT Security Specialist / Cybersecurity Engineer (Secret Clearance Required)

MPIRE Technology Group is seeking an experienced IT Security Specialist for a client role in Rosslyn, VA. This technical expert position focuses on application security, cybersecurity engineering, and information security design. Candidates must hold an active Secret Clearance.

Location Note: This role offers flexible telework but requires candidates to live within driving distance of Arlington, VA.

Key Responsibilities:

The specialist will solve significant security problems complicated by interfaces and inter-relationships across programs, systems, functions, and applications, supporting agency-wide IT solutions, operations, and maintenance for infrastructure, systems, and information security.

• Manages and administers a wide range of security systems and tools, including cloud-based security solutions.
• Administers Azure Security Center (Sentinel, Log Analytics, Azure WAF, Defender for Identity, Privileged Identity Manager).
• Manages Microsoft 365 Security Suite (Defender, Advanced Threat Protection, Cloud Application Security, Protection Portal).
• Oversees Microsoft Security and Compliance Center and Microsoft Endpoint Manager (Intune).
• Manages multi-factor authentication (MFA), web content filtering, and secure document sharing/collaboration solutions.
• Responsible for primary or alternate management of all IT Security systems, including patch management, upgrades, integration engineering, and reporting.
• Executes security-related operational activities and manages security incident detection, response, and remediation.
• Conducts cyber threat and vulnerability analysis and remediation.
• Develops security metrics and manages reporting and compliance.
• Serves as an Incident Response Team member.
• Supports operational implementation of FISMA/NIST standards and industry best practices.
• Manages the IT Security awareness training program in coordination with the Learning Management team, including developing and delivering training modules.
• Manages the Password Management system in coordination with the Service Desk.
• Responds to IT Security trouble tickets generated by customers and IT staff.
• Supports Security Operations and Engineering by providing technical solution support and expertise.
• Identifies security risks and recommends risk mitigation strategies.
• Reviews new and existing systems to ensure baseline security requirements are met and recommends security enhancements.
• Develops security architecture and technical solutions for security products.

Required Skills & Experience:

• 5+ years of experience in software development or a related field, focusing on cybersecurity.
• Must have an active Secret Clearance.
• Experience with Static and Dynamic Application Security Testing (SAST/DAST) using tools like HP Fortify, HP WebInspect, HCL Appscan, Snyk, Checkmarx, Synopsys, and Veracode.
• Specialized experience in Continuous Integration (CI) and Continuous Deployment (CD) practices.
• Experience in manual code review with the ability to identify potential vulnerabilities and best coding practices.
• Experience in application vulnerability and security assessments using various tools like Burp Suite Pro, OWASP Zap Proxy, DirBuster, Kali Linux, Metasploit Pro, Accunetix, Insight AppSec, GitLab, Coverity, Fortify, and GitHub Enterprise.
• Experience assessing application vulnerabilities and bugs in various applications.
• Experience creating security testing pipelines and test plans.
• Experience implementing and deploying an organization-wide Application Security program (DAST and SAST) at the enterprise level to identify, report, and remediate security vulnerabilities in development and production environments.
• Knowledge of coding languages such as Java, .NET, Python, PHP, C++, and C#.
• Extensive experience in preparing Test Plans, writing Test Cases, test Execution, and managing follow-up remediation efforts.
• Knowledge & Skill in implementing FISMA, NIST, OMB guidelines, and other Federal regulations and guidance.
• Experience interpreting and implementing FISMA/NIST requirements focused on operational implementation and documentation.
• Knowledge of security controls for cloud-hosted environments, applications, and services.
• Experience developing System Security Plans, Security Assessment Reports, Continuous Monitoring Plans, and Plans of Action & Milestones (POA&Ms).
• Ability to plan, organize, and manage tasks on time with minimal supervision.
• Ability to handle multiple tasks and work independently as well as in a team.

Clearance and Citizenship Requirements:

• Candidates MUST be a US Citizen and be able to obtain a Position of Public Trust Clearance.
• Must not have traveled outside the US for a combined total of 6 months or more in the last 5 years.
• Must have resided in the US for the last 5 years.

Nice to Have Certifications:

• Certified Secure Software Lifecyle Professional (CSSLP)
• Certified Cloud Security Professional (CCSP)
• Offensive Security Certified Professional (OSCP)
• EC-Council Certified Application Security Engineer (CASE)
• GIAC Certified Web Application Defender (GWEB)
• Azure Developer Associate
• Microsoft certification(s): Microsoft 365 Certified Security Administrator Associate, Microsoft Certified Azure Security Engineer Associate

Benefits:

• Health insurance
• Dental insurance
• Vision insurance
• Retirement plan
• Paid time off
• Professional development assistance