Information Systems Security Engineer; ISSE

• Architect, engineer, and implement technical security controls directly into system designs, operating systems, cloud environments, and networks to satisfy RMF Step 2 requirements.
• Apply, test, and enforce DISA STIGs, SRGs, and CIS benchmarks across Microsoft, RHEL operating systems, cloud assets, and virtualization infrastructure using both automated and manual validation methods.
• Deploy, configure, and execute automated vulnerability scanners—including ACAS/Tenable Nessus and the SCAP Compliance Checker (SCC)—to discover flaws and engineer technical, code-level, or system-level mitigations.
• Conduct deep-dive SIAs on all proposed system configuration changes, software updates, and network modifications to maintain a secure baseline.
• Author the technical "How-To" implementation statements within System Security Plans (SSPs) and generate verifiable engineering artifacts to prove control compliance.
• Analyze ACAS and SCAP raw scan outputs to determine residual risk, construct technical remediation pathways, and engineer custom workarounds for system-critical components that cannot be STIGed.
• Own the technical execution of Plan of Action and Milestones (POA&M) items, implementing patches, configuration changes, or architectural adjustments to close security gaps.
• Design, implement, and automate technical ISCM capabilities, including log aggregation, SIEM integration, and host-based security tools.
• Populate and maintain technical evidence, security control mappings, and network boundary diagrams within eMASS to support ongoing RMF accreditation.
• Act as the primary technical security liaison to software developers, system administrators, and network engineers to embed security into the development and operations pipelines.
• Engineer, validate, and audit Next-Generation Firewall (NGFW) rule architecture across on-prem and cloud boundaries, verifying application-layer filtering (App-), stateful inspection, and automated rule recertification workflows.
• Design, maintain, and validate host security baselines (ESS, EDR/XDR, Tanium), implementing behavioral detection, host-based firewall policies, Data Loss Prevention (DLP), and rapid host-containment procedures.
• Align system architectures with DoD Zero Trust pillars by engineering software-defined perimeters (SDP), micro-segmentation boundaries, and integrations between Policy Decision Points (PDP) and Policy Enforcement Points (PEP).
• Implement identity federation, PKI/CAC authentication, SAML 2.0, OAuth2, and OIDC, while architecting Privileged Access Management (PAM) controls, just-in-time (JIT) access, and Attribute-Based Access Control (ABAC) models.
• Configure and maintain secure log transport pipelines (Syslog-ng, Logstash), design SIEM/SOAR ingestion schemas, parsing engines, and correlation alert logics, and integrate Net Flow, Zeek, and NDR telemetry feeds.
• Review and validate Software Bills of Materials (SBOMs) and perform hardware/software provenance assessments in strict compliance with DoDI 5200.44 and Section 889 covered telecommunications prohibitions.
• Establish automated continuous monitoring (Con Mon) pipelines, integrating continuous threat scanning, real-time risk scoring, and automated compliance telemetry into organizational dashboards.

• Ten (10) or more years of experience.
• BS/BA
• Top-Secret clearance required with SCI or SCI eligibility.
• DoD 8570 IAM Level II or III compliant certification and computing environment certifications required.

We are seeking an ISSE to join our Prime Contract with the Defense Threat Reduction Agency.

Tek Synap is a fast-growing high-tech company that understands both the pace of technology today and the need to have a comprehensive well…