Security Engineer -Greenbelt, MD - Georgia IT Inc.
Greenbelt, MD
About the Job
Information Systems Application Security Engineer
Greenbelt, MD
6+ Months Contract
USC,GC & H1B Acceptable
Role Description:
The Information Systems Security Engineer will work seamlessly with the Security Engineer Lead to conduct security engineering activities,
to include:
Preferred Certifications: CISSP, CCNP, AWS SA, applicable MS certs
Responsibilities:
• Design, implement and monitor security measures for the protection of web sites, networks and information privacy
• Identify, define & implement system security requirements for external and internal facing web applications
• Work with the Infrastructure and Engineering Staff to incorporate tools and best practices that ensure control requirements are addressed to promote a robust security posture for the communications aspects of applications in both a private on premises data centers and public cloud offerings.
• Conduct assessments using COTS and other tools to ensure coding practices are followed and effective as well as identify risks.
• Ensure the secure esign, architecture, installation, configuration, hardening, and remediation for software applications to protect organizations' sensitive information for On-Prem and Cloud environments.
• Validate that system and application design and architecture meet best practice Security standards
• Develop strategies to respond to and recover from a security breach. Information Security Engineers are also responsible for educating the workforce on information security through training and building awareness.
• Follows documented application technical approaches to assess threats and residual risks, along with specifying the implementations required for the 2020 Decennial Census.
• Utilizes the organization tasking tracking database, framework and application to manage security operations and make the necessary reports based on due dates, assignments, coordination requirements, percent of completion, completion and archival. Devises solutions to operational problems within the capacity and operational limitations of installed equipment.
• Analyzes Decennial change requests for security impacts to applications and provides recommendations to the 2020 Census TI Leadership.
• Monitors and tracks application related security defects and resolutions; assigns tasks to the appropriate working group or individual. Coordinates and facilitates working groups and integrated process teams to achieve solution.
• Assists in establishing and implementing a Continuous Diagnostics and Mitigation (CDM) capability within application environments to ensureintegrated security controls for the 2020 Census System of Systems (SoS).
• Focuses on application interface management as it relates to security impacts and networking needs between Cloud and on premises Data Centers, and Cloud and Internet (VPN) users
• Works within a Sprint to ensure engineering features and enhancements include security requirements and meet Federal directives. Acts as a bridge between project teams or developers and security personnel, by being able to understand and interface in all areas. Identifies specific areas of concern related to securing sensitive data in a both a cloud and data center environment.
• Provides thought leadership to provide guidance and best practices for the implementation of SoS to support the 2020 Decennial Census.
• Provides expertise with Federal Requirements related to special classifications of data especially Title 13 and 26, FISMA, FedRAMP. NIST, etc.
• Generates documentation as required by the US Census.
Required Experience:
• Acquisition, design, deployment, installation, maintenance, and usage of the Government Enterprise networks.
• Engineering solutions within multiple Cloud Service Providers, in particular AWS.
• Enterprise level security hardening for Windows, Linux, Android and/or iOS operating systems and SQL, Oracle, and RDS database solutions in accordance with Center for Internet Security (CIS) and Security Technical Implementation Technical Guides (STIGs)
• Experience conducting web application and code testing for all systems and applications, and open source dependencies, providing analysis and risk assessments for vulnerabilities discovered. Oversees development and implementation of vulnerability remediation strategies. Configuration and execution of vulnerability and web application scans.
• Experience with automating server configuration for security including logging, key changes, and system hardening.
Required Skills:
• Knowledge of web application attacks and defense strategies including those found in the OWASP Top 10 and mobile Top 10Knowledge of encryption, key management and cryptology
• Understanding of the Amazon Web Services (AWS) Well Architected Framework
• Familiarity with the Risk Management Framework (NIST 800-37), Security Controls as described in NIST 800-35, and the Federal Information Security Modernization Act (FISMA) operating standards and applicable guidelines
• Experience with performing threat modelling, risk analysis, root cause analysis, risk identification, and risk mitigation
• Experience with application security assessment tools such as: AppScan, WebInspect, Fortify, Veracode, WebScarab, Paros Proxy, Burp Suite, etcFamiliarity with a variety of web application protocols, web services (components including JavaScript, XML, JSON), scripting capabilities (Powershell, Python) software development frameworks, operating systems, and networking technologies. Understanding of various web application frameworks such as ASP.NET, J2EE
• Organizational Skills: Proven ability to plan and prioritize work, both their own and that of project team. Follows tasks to their logical conclusion. Understanding of project management principles and techniques (project plans, critical path, etc), ability to develop security project plans and work with development teams to integrate those into development schedules - in both waterfall and agile environments.
o Team Work: Excels both autonomously and as part of a team. Prepared to challenge ideas within a group in a constructive way. Ability to influence others and move a team toward a common vision or goal.
o Leadership: Acute business acumen and understanding of organizational issues and challenges. Able to work effectively at all levels in an organization.
o Communications: Ability to interact with senior managers, junior staff, and business unit (non-technical) customers clearly and efficiently, both verbally and in writing. Able to present ideas in a variety of ways depending upon audience and context. Excellent active listening skills.
o Problem Solving: Natural inclination for planning strategy and tactics. Ability to analyze problems and determine root cause, generating alternatives, evaluating and selecting alternatives and implementing solutions.
o Results oriented: Able to drive things forward regardless of personal interest in the task.
Greenbelt, MD
6+ Months Contract
USC,GC & H1B Acceptable
Role Description:
The Information Systems Security Engineer will work seamlessly with the Security Engineer Lead to conduct security engineering activities,
to include:
Preferred Certifications: CISSP, CCNP, AWS SA, applicable MS certs
Responsibilities:
• Design, implement and monitor security measures for the protection of web sites, networks and information privacy
• Identify, define & implement system security requirements for external and internal facing web applications
• Work with the Infrastructure and Engineering Staff to incorporate tools and best practices that ensure control requirements are addressed to promote a robust security posture for the communications aspects of applications in both a private on premises data centers and public cloud offerings.
• Conduct assessments using COTS and other tools to ensure coding practices are followed and effective as well as identify risks.
• Ensure the secure esign, architecture, installation, configuration, hardening, and remediation for software applications to protect organizations' sensitive information for On-Prem and Cloud environments.
• Validate that system and application design and architecture meet best practice Security standards
• Develop strategies to respond to and recover from a security breach. Information Security Engineers are also responsible for educating the workforce on information security through training and building awareness.
• Follows documented application technical approaches to assess threats and residual risks, along with specifying the implementations required for the 2020 Decennial Census.
• Utilizes the organization tasking tracking database, framework and application to manage security operations and make the necessary reports based on due dates, assignments, coordination requirements, percent of completion, completion and archival. Devises solutions to operational problems within the capacity and operational limitations of installed equipment.
• Analyzes Decennial change requests for security impacts to applications and provides recommendations to the 2020 Census TI Leadership.
• Monitors and tracks application related security defects and resolutions; assigns tasks to the appropriate working group or individual. Coordinates and facilitates working groups and integrated process teams to achieve solution.
• Assists in establishing and implementing a Continuous Diagnostics and Mitigation (CDM) capability within application environments to ensureintegrated security controls for the 2020 Census System of Systems (SoS).
• Focuses on application interface management as it relates to security impacts and networking needs between Cloud and on premises Data Centers, and Cloud and Internet (VPN) users
• Works within a Sprint to ensure engineering features and enhancements include security requirements and meet Federal directives. Acts as a bridge between project teams or developers and security personnel, by being able to understand and interface in all areas. Identifies specific areas of concern related to securing sensitive data in a both a cloud and data center environment.
• Provides thought leadership to provide guidance and best practices for the implementation of SoS to support the 2020 Decennial Census.
• Provides expertise with Federal Requirements related to special classifications of data especially Title 13 and 26, FISMA, FedRAMP. NIST, etc.
• Generates documentation as required by the US Census.
Required Experience:
• Acquisition, design, deployment, installation, maintenance, and usage of the Government Enterprise networks.
• Engineering solutions within multiple Cloud Service Providers, in particular AWS.
• Enterprise level security hardening for Windows, Linux, Android and/or iOS operating systems and SQL, Oracle, and RDS database solutions in accordance with Center for Internet Security (CIS) and Security Technical Implementation Technical Guides (STIGs)
• Experience conducting web application and code testing for all systems and applications, and open source dependencies, providing analysis and risk assessments for vulnerabilities discovered. Oversees development and implementation of vulnerability remediation strategies. Configuration and execution of vulnerability and web application scans.
• Experience with automating server configuration for security including logging, key changes, and system hardening.
Required Skills:
• Knowledge of web application attacks and defense strategies including those found in the OWASP Top 10 and mobile Top 10Knowledge of encryption, key management and cryptology
• Understanding of the Amazon Web Services (AWS) Well Architected Framework
• Familiarity with the Risk Management Framework (NIST 800-37), Security Controls as described in NIST 800-35, and the Federal Information Security Modernization Act (FISMA) operating standards and applicable guidelines
• Experience with performing threat modelling, risk analysis, root cause analysis, risk identification, and risk mitigation
• Experience with application security assessment tools such as: AppScan, WebInspect, Fortify, Veracode, WebScarab, Paros Proxy, Burp Suite, etcFamiliarity with a variety of web application protocols, web services (components including JavaScript, XML, JSON), scripting capabilities (Powershell, Python) software development frameworks, operating systems, and networking technologies. Understanding of various web application frameworks such as ASP.NET, J2EE
• Organizational Skills: Proven ability to plan and prioritize work, both their own and that of project team. Follows tasks to their logical conclusion. Understanding of project management principles and techniques (project plans, critical path, etc), ability to develop security project plans and work with development teams to integrate those into development schedules - in both waterfall and agile environments.
o Team Work: Excels both autonomously and as part of a team. Prepared to challenge ideas within a group in a constructive way. Ability to influence others and move a team toward a common vision or goal.
o Leadership: Acute business acumen and understanding of organizational issues and challenges. Able to work effectively at all levels in an organization.
o Communications: Ability to interact with senior managers, junior staff, and business unit (non-technical) customers clearly and efficiently, both verbally and in writing. Able to present ideas in a variety of ways depending upon audience and context. Excellent active listening skills.
o Problem Solving: Natural inclination for planning strategy and tactics. Ability to analyze problems and determine root cause, generating alternatives, evaluating and selecting alternatives and implementing solutions.
o Results oriented: Able to drive things forward regardless of personal interest in the task.
Source : Georgia IT Inc.