Cybersecurity Engineer

This is an engineering position, not a scanning position. This position is not here to run ACAS sweeps and transcribe findings into spreadsheets. This role is about building the automation that makes hardening, evidence generation, and supply chain assurance a property of the build system. If a control can be enforced by code and proven by an artifact, your job is to make that happen and to make it repeatable across every baseline we deliver.

You will own the security engineering layer across our development and delivery environments, working alongside the embedded, firmware, and platform teams.

STIG and SRG automation

• Design and maintain automated hardening for RHEL, Windows, container, network device, and application baselines against applicable DISA STIGs and SRGs
• Author, tailor, and validate SCAP and OpenSCAP content; build and maintain idempotent Ansible-based roles
• Automate STIG checklist (CKL) generation, deviation documentation, and evidence packaging so that compliance state is a build output rather than a manual exercise
• Engineer tailoring decisions for embedded and real-time targets where stock STIG guidance breaks the mission and document the technical rationale and compensating controls that makes those deviations defensible in review

Software bill of materials

• Stand up automated SBOM generation (CycloneDX or SPDX) across firmware, embedded, and application build pipelines, including for cross-compiled and constrained targets
• Integrate SBOM production into CI so every delivered artifact ships with an accurate, signed component inventory
• Produce and maintain VEX documentation to communicate real exploitability rather than raw CVE counts
• Ensure SBOM output satisfies customer and NDAA/EO supply chain delivery requirements

Supply chain security and remediation

• Triage dependency and component vulnerabilities on technical merit and drive remediation with the engineering teams
• Implement artifact signing, provenance, and build attestation (Sigstore/cosign, SLSA-aligned practices) across the delivery chain
• Track upstream advisories and patch availability; own the engineering response when a component goes unmaintained or a fix does not exist

Pipeline and platform

• Build security gates into CI/CD across both unclassified and accredited enclaves, including air-gapped environments
• Implement policy-as-code, IaC scanning, and secrets management within the build system
• Automate the production of RMF evidence artifacts to shorten the ATO path