Cybersecurity Engineer

Caribou Thunder is seeking a Cybersecurity Engineer to support cybersecurity engineering and Risk Management Framework (RMF) activities for mission-critical defense systems. This onsite role in Colorado Springs, CO focuses on security compliance, vulnerability identification, control validation, and Assessment and Authorization (A&A) support, working closely with engineering teams, program personnel, and Government stakeholders.

The position contributes to maintaining secure system configurations and keeping RMF documentation and evidence current for authorization and continued operation, including coordination with program offices and systems records management.

• Assess systems and networks to identify deviations from approved configurations, enclave policies, security baselines, and local security requirements.
• Perform security compliance evaluations using tools such as STIG Viewer
  , SCAP
  , Evaluate-STIG
  , STIG Manager
  , and other applicable compliance assessment technologies.
• Author, update, and review security testing documentation, including security assessment plans, test cases, and cybersecurity test methodologies.
• Conduct annual security control assessments and support continuous monitoring to verify control effectiveness over time.
• Provide technical input for Security Assessment Reports (SARs), Risk Assessment Reports (RARs), and other cybersecurity assessment deliverables.
• Coordinate with the program’s System Program Office (SPO) contractor and Government personnel to maintain accurate system records in eMASS
  .
• Collect, prepare, organize, and maintain RMF body of evidence, including documentation of operational processes, procedures, and site-specific security requirements.
• Prepare and update RMF artifacts supporting A&A, including Plans of Action and Milestones (POA&Ms).
• Review RMF documentation and security artifacts to identify gaps, inconsistencies, and deviations from applicable security control requirements.
• Support implementation of Government cybersecurity policies and standards, including NISPOM
  , NIST
  , DoD
  , and Air Force instructions as applicable.
• Establish and maintain program control processes that support risk mitigation, security compliance, and system authorization.
• Assist with control certification testing, compliance documentation, technical investigations, software research, hardware introduction and release activities, emerging technology research, inspections, and periodic audits.
• Analyze cybersecurity controls and requirements to validate effectiveness and recommend safeguards.
• Coordinate with program stakeholders to investigate and resolve deficiencies found during RMF assessments.
• Support vulnerability management, system hardening, and remediation activities to strengthen the security posture of systems and networks.
• Collaborate with cybersecurity engineers, system administrators, software teams, and Government representatives to maintain compliance with security requirements.
• Maintain clear technical documentation and communicate assessment results, risks, and recommended corrective actions to relevant stakeholders.
• Level 3 engineers will take on greater responsibility for complex assessments, RMF artifact reviews, deficiency resolution, and coordination of cybersecurity activities across the program.

• Bachelor’s degree and 5 years of relevant work experience; OR Master’s degree and 3 years
  ; OR PhD and 1 year
  .
• Active U.S. Government Secret security clearance, current and within scope, at the time of application.
• Current DoD 8570.01M IAT Level II certification, such as Security+ CE
  , CCNA Security
  , GSEC
  , or SSCP
  .
• Experience in cybersecurity or security engineering, including cybersecurity principles, risk management, security assessments, vulnerability…