Security Engineer; Levels

Overview

The Information Systems Security Engineer/Analyst provides security engineering, analysis, and compliance support for FAA systems and applications. This role focuses on security planning, risk management, certification and authorization (C&A), system security documentation, and the implementation and assessment of security controls. The role supports the implementation, integration, and ongoing operation of National Airspace System (NAS) and FAA information systems, ensuring systems meet FAA, federal, and NIST security requirements throughout the system development life cycle.

Security Engineering & Analysis

• Provide information systems security analysis, design support, and implementation assistance
• Conduct system engineering studies and security assessments
• Identify security risks, vulnerabilities, and threats, and recommend mitigation strategies
• Perform preliminary vulnerability testing early in the system development life cycle
• Analyze security impacts of system changes and modifications

Compliance, Certification & Authorization

• Support Certification and Authorization (C&A) activities and documentation
• Implement and sustain FAA Information Systems Security Program (ISSP) controls
• Develop and maintain System Security Plans (SSP), Security Impact Analyses, and POA&M documentation
• Ensure compliance with FAA directives, federal regulations, and NIST standards (including NIST 800-53)
• Support processing of Security Certification and Authorization Process (SCAP) requirements

Security Controls & Domains

• Provide Subject Matter Expertise Across Security Domains, Including
• Access control systems
• Network and telecommunications security
• Application and systems development security
• Cryptography
• Security architectures and models
• Operations security

Testing, Audits & Documentation

• Support security testing, validation, and acceptance activities
• Review and develop security-related documentation for audits and assessments
• Assist with test procedures, standards, and evaluation documentation
• Provide technical security support during factory acceptance tests and system testing

Continuity & Risk Management

• Support business continuity and disaster recovery planning and exercises
• Participate in disaster recovery planning and execution of test events
• Ensure the operational security posture of systems, programs, and designated assets
• Serve as a security advisor to program management and technical teams

Basic Qualifications

• Experience in information systems security, cybersecurity, or security engineering
• Knowledge of federal and FAA security requirements and standards
• Familiarity with NIST security frameworks (e.g., NIST 800-53)
• Experience developing and maintaining security documentation (SSP, POA&M, risk assessments)
• Ability to analyze system vulnerabilities and recommend security controls
• Strong written and verbal communication skills
• Ability to work collaboratively with engineering, operations, and program teams

Senior-level

• Minimum of 15 years’ experience with bachelor’s degree in any engineering field
• Master s degree in related field may be substituted for bachelor’s degree and 3 years’ experience
• PhD in related field may be substituted for bachelor’s degree and 7 years’ experience
• Compensation Ranges: $114,390 - $240,350

Mid-level

• Minimum of 10 years’ experience with bachelor’s degree in any engineering field
• Master s degree in related field may be substituted for bachelor’s degree and 3 years’ experience
• PhD in related field may be substituted for bachelor’s degree and 7 years’ experience
• Compensation Ranges: $94,590 - $164,125

Junior-level

• Minimum of 2 years’ experience with bachelor’s degree in any engineering field
• Master s degree in related field may be substituted for bachelor’s degree and 3 years’ experience
• PhD in related field may be substituted for bachelor’s degree and 7 years’ experience
• Compensation Ranges: $71,010 - $135,625

Desired Qualifications

• Experience supporting FAA, NAS, or other federal systems
• Knowledge of system development life cycle (SDLC) security integration
• Experience supporting audits, security assessments, and test activities
• Relevant security certifications (as required by program or contract)