Information Systems Security Engineer - Entry to Mid Level

At the U.S. National Security Agency/Central Security Service (NSA), Information Systems Security Professionals help architect, design, operate, defend, and maintain secure IT systems that support NSA SIGINT and Cybersecurity missions. This onsite role at Fort Meade, Maryland applies full life-cycle security engineering to manage risk, remediate vulnerabilities, and maintain compliance with relevant standards.

Working within security engineering teams, you will contribute to securing hybrid environments, including cloud services, while supporting authorization and continuous monitoring activities. The position is a permanent, full-time appointment in the Excepted Service, with eligibility for benefits based on the type of appointment.

• Design system and network architectures to enforce confidentiality, integrity, and availability
  .
• Apply systems engineering principles and methodology
  .
• Define and manage remediation plans across applications, infrastructure, and cloud environments.
• Ensure compliance with cybersecurity standards and regulatory requirements (for example NIST
  ).
• Assess and mitigate risks in legacy systems, misconfigurations, and vulnerabilities.
• Analyze and prioritize vulnerabilities in collaboration with cross-functional teams.
• Lead and provide oversight for patching and hardening of infrastructure systems.
• Define information system security requirements and functionality.
• Review cloud service security configuration options and recommend secure configurations.
• Use knowledge of cryptography and programming capability (including Python and Java
  ).
• Assess the effectiveness of security solutions against cybersecurity frameworks such as MITRE ATT&CK
  .
• Monitor cybersecurity hygiene for a family of IT systems and direct remediation of configuration and vulnerability findings to reduce adversary risk.
• Apply concepts, principles, structure, and standards to design, implement, monitor, and secure operating systems, equipment, networks, applications, and controls.
• Operate within teams implementing and evolving procedures and security settings for protecting data and applications in cloud environments.
• Conduct security engineering and hardening of the latest operating systems, tailoring them for specific mission needs.
• Implement automation and artificial intelligence across the RMF authorization life cycle into continuous monitoring.

• All applicants and employees are subject to random drug testing in accordance with Executive Order 12564.
• Relevant experience must be in one or more areas such as computer or information systems design/development; programming; information/cyber/network security; system or network administration; vulnerability analysis; penetration testing; computer forensics; systems engineering; computer systems research; reverse engineering; or updating information assurance documentation (for example System Security Plans, Risk Assessment Reports, Certification and Accreditation packages, and System R…).
• Completion of military training in relevant areas (such as JCAC, UCT, NWBC/INWT, or Cyber Defense Operations) may count toward the relevant experience requirement, based on course duration.
• Cybersecurity certifications (for example NET+,
  Security+,
  CISSP
  , and CAP
  ) may count as a total of 1 year of experience.
• Entry/Developmental: Associate’s degree plus 2 years of relevant experience, or a Bachelor’s degree with no experience.
• Full Performance: Associate’s degree plus 5 years of relevant experience;
  Bachelor’s degree plus 3 years of relevant experience;
  Master’s degree plus 1 year of relevant experience; or Doctoral degree with no experience.
• Degree must be in Computer Science or a related field (examples include Engineering, Mathematics, Data Science, Artificial…