Cybersecurity Engineer II; InSITE; Secret Clearance

Working across the globe, V2X builds smart solutions designed to integrate physical and digital infrastructure from base to battlefield. We bring 120 years of successful mission support to improve security, streamline logistics, and enhance readiness. Aligned around a shared purpose, our $3.9B company and 16,000 people work alongside our clients, here and abroad, to tackle their most complex challenges with integrity, respect, responsibility, and professionalism.

• Provide cyber programmatic support for InSITE:
• Support program planning and estimation for cybersecurity tasks.
• Represent cybersecurity at TIMs and Agile ceremonies (planning, reviews, retrospectives).
• Troubleshoot and resolve or elevate security-related issues across Dev/Test/Prod environments.
• Lead static code analysis activities:
• Plan and execute static application security scans (e.g., Sonar Qube or equivalent) per sprint.
• Analyze scan results, identify false positives, and prioritize vulnerabilities based on risk.
• Collaborate with development teams to define remediation approaches and timelines.
• Track remediation status and verify closure through re-scans.
• Conduct web application vulnerability scanning:
• Plan and execute web application security scans for each release using approved DAST tools.
• Interpret results and consolidate findings into actionable reports.
• Work with developers and system administrators to ensure remediation is scheduled and completed.
• Execute monthly vulnerability assessments:
• Prepare and configure scanning of virtual servers and infrastructure across Dev/Test/Prod (~20 servers).
• Run vulnerability scans and perform detailed analysis of findings.
• Correlate, deduplicate, and prioritize vulnerabilities; document risk and remediation recommendations.
• Coordinate cyber remediation activities with system owners and track progress.
• Update security documentation, dashboards, and continuous monitoring records.
• Perform quarterly STIG and SRG assessments:
• Conduct DISA STIG/SRG reviews for technologies including:
• ASD STIG;
  Cloud Computing Mission Owner Network and OS SRGs.
• Microsoft Windows Server, IIS (Server/Site), .NET Framework, Azure SQL.
• Endpoint security tools, browsers, and host firewalls.
• Document compliance status, deviations, mitigations, and residual risk.
• Maintain STIG checklists and ensure updates are reflected in system baselines.
• Support penetration testing and advanced assessments:
• Assist in scoping and planning penetration tests (including rules of engagement).
• Perform or support penetration testing under guidance of senior staff.
• Contribute to penetration test reports with technical details and recommended mitigations.
• Support ATO / RMF and continuous monitoring:
• Contribute to the development and maintenance of the Security Authorization Package.
• Provide control implementation evidence, participate in control assessments, and support POA&M management.
• Perform continuous monitoring tasks such as periodic scans, log review support, and compliance status updates.
• Prepare and maintain technical documentation and reports:
• Produce clear, concise vulnerability and scan reports for internal and external stakeholders.
• Update run books, procedures, and standard operating instructions for assessment activities.
• Provide guidance and mentorship to junior cybersecurity staff as needed.
• Perform other duties as assigned in support of W-TRS and GTS.

Education & Experience:

• Bachelor’s degree in Cybersecurity, Computer Science, Information Systems, Engineering, or related field; or an equivalent combination of education and experience.
• Typically 3-6 years of cybersecurity, system security engineering, or closely related experience.

Proven experience leading:

• Application security assessments (SAST/DAST, vulnerability scans) for complex systems.
• DISA STIG/SRG-based hardening for servers, applications, and databases.
• RMF/ATO efforts and continuous monitoring for government/regulated systems.
• Vulnerability scanning and management in multi-environment deployments.

Knowledge, Skills & Abilities:

• Expert knowledge of application security, OWASP Top 10, and secure SDLC practices.
• Strong experience with vulnerability management across Dev/Test/Prod and with Windows Server, IIS, SQL/Azure SQL, and cloud-hosted environments.
• Hands-on experience with:
  Enterprise vulnerability tools (e.g., Tenable/Nessus, Qualys, Rapid
  7).
  Application security tools (e.g., Sonar Qube, Fortify, Veracode, Burp Suite, OWASP ZAP).
  DISA STIGs, DoD SRGs, and their implementation in production…