Principal Cyber Security Analyst - Software Engineering

Principal Cyber Security Analyst - Software Engineering

North Las Vegas, NV, United States

Mission Support and Test Services, LLC (MSTS) manages and operates the Nevada National Security Site (NNSS) for the U.S. National Nuclear Security Administration (NNSA). Our MISSION is to help ensure the security of the United States and its allies by providing high-hazard experimentation and incident response capabilities through operations, engineering, education, field, and integration services and by acting as environmental stewards to the Site’s Cold War legacy.

Our VISION is to be the user site of choice for large-scale, high-hazard, national security experimentation, with premier facilities and capabilities below ground, on the ground, and in the air. (See NNSS.gov for our unique capabilities.) Our 2,750+ professional, craft, and support employees are called upon to innovate, collaborate, and deliver on some of the more difficult nuclear security challenges facing the world today.

• MSTS offers our full-time employees highly competitive salaries and benefits packages including medical, dental, and vision; both a pension and a 401k; paid time off and 96 hours of paid holidays; relocation (if located more than 75 miles from work location); tuition assistance and reimbursement; and more.
• MSTS is a limited liability company consisting of Honeywell International Inc. (Honeywell), Jacobs Engineering Group Inc. (Jacobs), and HII Nuclear Inc.

MSTS is seeking a highly experienced Cybersecurity professional for a Principal Software Security Engineer. The software engineer in this role (Principal Cyber Security Analyst) will be responsible for leading the testing, implementation, operation, and maintenance of secure software solutions, ensuring confidentiality, integrity, and the availability of sensitive data.

• Implement, test, and operate advanced software security in compliance with federal security requirements including SBOM (Software Bill of Materials) policy enforcement.
• Serve as the System Administrator for CI/CD related tools and equipment.
• Lead the effort to automate application scanning and vulnerability assessment processes to support CI/CD (Continuous Integration and Continuous Delivery/Deployment) releases.
• Develop and maintain software C-SCRM program to continuously monitor and periodically reassess critical software and suppliers.
• Conduct threat hunting and mitigations on malicious packages.
• Assist with AI architecture development as well as source code vetting.
• Provide engineering designs for new software applications to help mitigate security vulnerabilities.
• Brief executive management as the security subject matter expert on software development and related opportunities within the enterprise.
• Perform ongoing security testing and code review to improve software security.
• Validate identified security issues within applications and recommend fixes.
• Develop programs to train team members on secure coding practices.
• Create and maintain technical documentation.
• Lead team in researching, compiling, and analyzing technical data for software related tasks.
• Perform Security Test and Evaluations of information systems in support of a security plan.
• Write complex information system plans (ISSPs) for classified and unclassified systems.
• Complete certification and accreditation of information systems on unclassified and classified networks, assist with the completion and mitigation of security testing and evaluation results, and be a resource for MSTS and other NvE enterprises for the Certification and Accreditation (C&A) process.
• Review purchase requests for technology items and provide input for senior level Cyber Security staff regarding the risks associated with purchases.
• Assist the Information System Security Manager (ISSM) and Information System Security Officers (ISSOs) with the execution of their assigned duties, act as a liaison between the ISSM and other ISSOs, and provide training to ISSOs about their Cyber Security role.
• Serve as the primary point of contact for software related data calls, Federal Information Security Modernization Act (FISMA) reporting,…