Cyber Test Engineer

Description

The company is an information technology and financial management consulting firm. This role supports the Information System Security Officer and Information System Security Engineer with security compliance, automated testing, and continuous monitoring in an Impact Level 5 multi-cloud environment.

The work is a complex, mission-critical project that requires coordinating many stakeholders, systems, and linked requirements.

Responsibilities

• Build and upkeep automated capabilities for security compliance, testing, and continuous monitoring.
• Automate DISA STIG and SCAP benchmark scans.
• Run ongoing DISA SCAP benchmark scans with ACAS, Tenable SecurityCenter, and Nessus.
• Check XCCDF, ARF, and CKL files with SCAP Compliance Checker.
• Automate Trellix Policy Auditor scans for STIG compliance.
• Build and maintain Tricentis test automation for SAP and Mendix regression testing.
• Add SonarQube quality gates and Fortify static application security testing to CI/CD pipelines.
• Support software bill of materials generation under the CycloneDX and SPDX standards.
• Create GitLab CI/CD pipelines with automated security gates.
• Validate Infrastructure as Code written in Terraform and AWS CloudFormation.
• Send security scanning results into AWS Security Hub.
• Write Splunk Enterprise Security queries and automate security alerts.
• Build Splunk SOAR playbooks for automated incident response.
• Put Enterprise Security Content Updates detection rules in place.
• Connect to the eMASS API to automate uploads of compliance evidence.
• Write AWS Config conformance packs for continuous compliance.
• Automate security controls with AWS Audit Manager.
• Automate the evidence pipeline for Continuous Operational Readiness Assessment.

Requirements

• At least four years of experience in security automation, compliance testing, DevSecOps, or a related field.
• Able to meet the applicable DoD 8140 qualification requirements for the System Testing and Evaluation Specialist work role.
• Hold an applicable cybersecurity certification, such as Certified Ethical Hacker, CyberSec First Responder, CompTIA Cloud+, GIAC Security Essentials, CompTIA PenTest+, CompTIA Security+, or Systems Security Certified Practitioner.
• Experience with ACAS, Tenable SecurityCenter, Nessus, SCAP Compliance Checker, or Trellix Policy Auditor.
• Experience with Tricentis automation for SAP or Mendix regression testing.
• Experience adding SonarQube quality gates or Fortify static application security testing to CI/CD pipelines.
• Experience producing software bills of materials with CycloneDX or SPDX.
• Experience building GitLab CI/CD pipelines with automated security gates.
• Experience testing or validating Infrastructure as Code in Terraform or AWS CloudFormation.
• Experience sending security scanning results to AWS Security Hub.
• Experience with Splunk Enterprise Security queries, automated alerts, or Splunk SOAR playbooks.
• Experience with eMASS API integrations, AWS Config conformance packs, AWS Audit Manager, or similar compliance automation.
• Creative and adaptable when solving problems.
• Able to work with clients to learn what they need.
• Strong at organizing work and managing time.
• Excellent written and spoken communication.
• Professional presence.
• Preferred: scripting skill in Python, PowerShell, or Bash.
• Preferred: experience working within AWS GovCloud.
• Preferred: experience with AWS Lambda, Amazon EventBridge, or AWS Step Functions.
• Preferred: understanding of Risk Management Framework continuous monitoring requirements.
• Preferred: experience in a Scaled Agile Framework environment.
• Preferred: experience taking part in Program Increment planning.
• Preferred: strong analytical and troubleshooting skills, with the ability to explain technical matters clearly.
• Preferred: able to work independently and with cybersecurity, engineering, compliance, and development teams.
• Preferred: able to work on a team as well as alone.
• Preferred: strong skills in building relationships with customers and vendors.
• Preferred: demonstrated adherence to data standards and policies.
• Preferred: willing to learn new technologies and methods that prove their value.
• Preferred: past work with a federal government agency.
• Preferred: Department of War experience.

Conditions

Only U.S. citizens are eligible.

You must be able to obtain a Federal Secret security clearance.

Preferred: an active clearance.

Benefits

• Competitive salary.
• Generous paid time off package.
• Paid holidays that follow the Federal calendar.
• Full health coverage, including medical, dental, vision, and life insurance.
• 401(k) retirement plan.
• Team-building events.
• Support for professional development.