Senior Baseline Security Engineer; CIS & STIGs

Status:
Active - Immediate Need

Location:

Fully remote - U.S. only (no time on the client site expected)

Focus Areas: CIS Benchmarks, DISA STIGs, Secure Configuration Baselines, Tenable Compliance Verification, and NIST 800-53 / FISMA Control Mapping

At phia we hire talented and passionate people who are focused on collaborative, meaningful work, providing technical and operational subject matter expertise and support services to our partners and clients. phia is seeking a mission-driven Senior Baseline Security Engineer to build and maintain the secure configuration baselines that protect a federal financial regulatory agency's enterprise.

You will step into an established baseline program as one of two contractors working with a federal lead, and own your assigned baselines end to end: creating, reviewing, and customizing security configuration baselines from CIS Benchmarks and DISA STIGs, tailoring controls with each system's team rather than applying benchmarks out of the box, writing new baselines from vendor documentation where no benchmark exists, verifying systems with Tenable, and translating low-level settings into the FISMA, NIST 800-53, and client-specific security requirements the agency is measured against.

The platform mix changes as new systems need baselines, so you will learn new technologies as you go.

• Build Baselines:
  Create security configuration baselines using CIS Benchmarks and DISA STIGs.
• Tailor Benchmarks:
  Modify CIS and STIG benchmarks to meet the client's organizational requirements, working with each system's team to negotiate and document deviations and justifications.
• Write from Scratch:
  Develop new baselines from vendor documentation for technologies without an existing benchmark.
• Map to Controls:
  Translate low-level baseline settings into high-level FISMA, NIST 800-53, and client-specific security requirements.
• Use Vulnerability Data:
  Apply NVD and CVE information to keep baselines current with emerging vulnerabilities.
• Verify with Tenable:
  Run compliance scans to assess systems against existing baselines, reconcile findings with system owners, and keep baseline and scan results in step.
• Learn New Platforms:
  Pick up whatever technology needs a baseline next - servers, network devices, cloud and SaaS services, mobile - and build competence quickly from vendor documentation.
• Work Independently:
  Own assigned baselines with a light touch from the federal lead, and communicate status, deviations, and risk clearly.
• Support IT Operations:
  Review and customize general security configuration baselines and support their rollout across the environment.

• IT Operations Veteran: 5+ years supporting IT operations.
• CIS & STIG Hands-On:
  You have created baselines using CIS and STIG benchmarks and modified them for an organization.
• Baseline Author:
  You can build a baseline from scratch from vendor documentation.
• NIST-Fluent:
  You know the NIST 800 series (800-30,
  -37,
  -53,
  -60,
  -63,
  -115,
  -137) and can map settings to controls.
• Vulnerability-Aware:
  Comfortable with NVD and CVE data.
• Scripting-Comfortable:
  Working familiarity with Linux; you can write a quick bash, Power Shell, or Python check to verify a setting, and you are at home with JSON/YAML.
• Tenable-Capable:
  You have verified baselines with Tenable (Nessus / Security Center) or a comparable compliance scanner.
• Autonomous Communicator:
  Comfortable owning work with minimal supervision, and clear with system owners when a control needs to bend.

• 5+ years of experience providing support to Information Technology (IT) operations.

• Experience creating security baselines using CIS and STIG benchmarks.
• Experience reviewing, developing, or customizing general security configuration…