Lead Cybersecurity Engineer

Description

• Serve as the technical lead for cybersecurity engineering activities supporting NIH CIT enterprise services, including network, email, endpoint, server, cloud, and related infrastructure environments.
• Architect, deploy, configure, integrate, operate, and improve cybersecurity tools and technologies used to inspect and protect network traffic, email traffic, endpoints, workstations, and servers.
• Lead security engineering activities involving threat detection, event analysis, log management, vulnerability identification, remediation validation, compromise assessments, and continuous monitoring.
• Provide subject-matter expertise in security industry standards, leading practices, and control implementation, with particular emphasis on compromise assessment, threat detection, endpoint protection, and network security.
• Administer, configure, tune, and analyze outputs from security platforms such as Tenable, Splunk, Big Fix, and comparable vulnerability-management, SIEM, endpoint-management, and security-monitoring tools.
• Conduct or support penetration testing, vulnerability assessments, security-control assessments, technical risk analyses, and validation of remediation activities.
• Analyze security events, vulnerabilities, system configurations, and threat indicators; identify risks; recommend mitigations; and track corrective actions through closure.
• Evaluate and help implement security controls across enterprise environments in alignment with RMF, continuous-monitoring requirements, and applicable HHS, NIH, DHS, and other federal cybersecurity policies and directives.
• Consult directly with Government stakeholders, system owners, technical teams, and program leadership on complex security-engineering issues, risk decisions, remediation strategies, and technical implementation approaches.
• Produce clear, accurate technical reports, dashboards, briefings, findings, risk assessments, remediation-status reports, and other artifacts that communicate progress and cybersecurity posture to both technical and executive audiences.
• Lead and mentor cybersecurity engineers and analysts; review technical work products; establish engineering priorities; and coordinate work across multiple concurrent cybersecurity initiatives.
• Participate in customer meetings, technical working groups, incident-related activities, and project reviews; communicate risks, dependencies, milestones, and recommended next steps.
• Develop and maintain standard operating procedures, engineering documentation, security architecture diagrams, implementation guides, and repeatable processes for cybersecurity operations.

Hybrid, 2-3 days per week on-site in Bethesda, MD.

• Minimum of three (3) to five (5) years of progressively responsible cybersecurity engineering, network security, information-security operations, or related technical experience.
• Security engineering for enterprise network, email, endpoint, workstation, server, and/or cloud environments.
• Architecting, deploying, configuring, and operating cybersecurity tools used for network inspection, email security, endpoint security, vulnerability management, security monitoring, or log analysis.
• Vulnerability management, continuous monitoring, compromise assessments, security-control assessments, penetration testing, or remediation validation.
• Security platforms such as Tenable, Splunk, Big Fix, or functionally comparable technologies.
• Network engineering and cybersecurity concepts, including traffic analysis, security logging, intrusion detection/prevention, endpoint protection, and system hardening.
• Preparing technical reports and customer-facing briefings that communicate security findings, risks, remediation progress, and recommended actions.
• Consulting with customers and technical stakeholders on security-engineering, compliance, risk-management, and remediation issues.
• Applying federal cybersecurity requirements, including familiarity with HHS, NIH, DHS, NIST, FISMA, RMF, and continuous-monitoring principles
• GIAC certification, current/active
• Certified Information Systems Security Professional (CISSP), current/active
• Splunk certification, such as Splunk Core Certified…