Senior Information Security Engineer

Description

Job Title: Senior Information Security Engineer  

Department: Operations – Services 

Reports To: RavenTek Program Manager  

Location: Remote 

Schedule: Monday – Friday 

Hours: Full-time, 40-hours/week

FLSA Status: Hourly, Nonexempt 

Clearance: Public Trust

Position Summary

The Senior Information Security Engineer will support the development, implementation, and maintenance of information security standards and configuration baselines to ensure systems meet established security requirements. This position is responsible for evaluating security configurations, identifying vulnerabilities, and applying industry best practices and federal security guidelines to strengthen system security and compliance. The role requires collaboration with technical teams and stakeholders to deliver secure, reliable, and effective IT solutions. The performance of this position is key to RavenTek's performance on the contract and therefore RavenTek's mission to support the customer.

Requirements

Essential Duties and Responsibilities

• Develop, review, and maintain security configuration baselines using vendor documentation, CIS benchmarks, and STIGs.
• Customize existing CIS and STIG benchmarks to meet organizational and customer-specific security requirements.
• Review and assess existing security configurations to identify vulnerabilities, security weaknesses, and compliance gaps.
• Research and analyze identified vulnerabilities using the National Vulnerability Database (NVD) and Common Vulnerabilities and Exposures (CVE).
• Translate technical security baseline requirements into applicable FISMA, NIST, and customer-specific security requirements.
• Apply NIST 800-series guidance to support risk management, security control implementation, and ongoing security compliance activities.
• Develop and maintain technical documentation related to security configuration baselines, standards, and security controls.
• Provide technical recommendations to address identified security vulnerabilities and improve system configurations.
• Collaborate with technical teams and stakeholders to support the implementation of security baselines and compliance requirements.
• Enter actual time worked, once complete, at the end of the day, or no later than 10:00 a.m. the following workday, and submit timesheets at the end of each pay period.
• Submit Status Reports on a regular basis, as required. 
• Monitor RavenTek email on a regular basis, at least 3 times per week, and respond accordingly.
• Complete required compliance training as assigned.
• Other duties as assigned.

Knowledge and Critical Skills

• Knowledge of the National Vulnerability Database (NVD) and Common Vulnerability Enumeration (CVE).
• Ability to create security baselines from scratch using vendor documentation.
• Ability to modify CIS and STIG benchmarks to meet organizational requirements.
• Ability to translate low-level security baseline requirements into high-level FISMA and NIST requirements and client-specific security.
• Ability to apply practical knowledge of commonly applied information security principles, concepts, and methodologies to resolve well-defined questions or conditions.
• Ability to meet deadlines and exercise efficiency in planning, prioritizing, and accomplishing assigned information and industrial security-related tasks. 
• Analytical skills: proactive, flexible, attention to detail, and organizational skills required. 
• Excellent written and spoken communication, presentation abilities, and teamwork skills.

Education & Work Experience

• High school diploma or GED required.
• Bachelor's degree preferred.
• Minimum of 5 years of experience supporting Information Technology (IT) operations.
• Experience creating security baselines using CIS and STIG benchmarks.
• Experience working with the NIST 800 Special Publication series guidance for risk management and security control implementation, including 800-30,800-37, 800-53, 800-60, 800-63, 800-115, or 800-137.
• Experience reviewing, developing, or customizing general security configuration baselines.
• Experience with networking technologies (Cisco, Juniper, Palo Alto); operating systems (Windows Server, Red Hat Linux); cloud services and platforms (AWS, Azure, Salesforce, Okta, Office 365, ServiceNow); or mobile technologies (iOS, XenMobile) is preferred.
• Experience designing, building, and implementing automation tools using Ansible, Chef, or Puppet is preferred.
• Experience with Infrastructure as Code (IaC) tools, including CloudFormation or Terraform, is preferred.
• Experience with container platforms, including OpenShift, is preferred.
• Experience with chaos engineering and blue-green deployments is preferred.
• Experience with serverless technologies, including AWS Lambda, API Gateway, Step Functions, and SAM, is preferred.
• Experience with application performance analysis and monitoring tools, including ELK, is preferred.
• Experience with JSON or YAML is preferred.

Certifications, Licenses

• AWS Certified Solutions Architect, preferred.
• AWS Certified Developer, preferred.
• Cisco Certified Network Associate (CCNA), preferred.
• Microsoft Certified Systems Engineer (MCSE), preferred.
• Red Hat Certified System Administrator (RHCSA), preferred.
• EBSA or ECSS Certification, preferred.

Special Requirements

• Ability to obtain and maintain a Public Trust and/or Suitability/Fitness determination based on client requirements.

Work Environment

Employee will be working indoors in a home office environment. Potential moderate temperature fluctuations. Typical indoor and computer related noise level, and typical office, paper, and equipment related dust. Exposure to video display terminals occurs on a regular basis.

Physical Demands

To successfully perform the essential functions of the job, the employee needs to be able to sit at a workstation for extended periods; use hand(s) to handle or feel objects, tools, or controls; reach with hands and arms; talk and hear; see to read printed materials and computer screens; mobility to work in a typical office setting. Ability to work on desktop or laptop computer for extended periods of time reading, reviewing/analyzing information, and may be required to provide recommendations, summaries and/or reports in written format. Must be able to effectively communicate with others verbally and in writing. Employee must be able to lift and/or move moderate amounts of weight, typically up to 20 pounds. Regular and predictable attendance is essential. 

ADA: RavenTek will make reasonable accommodations in compliance with the Americans with Disabilities Act of 1990.

EEO/AA: RavenTek does not discriminate based on race, color, national origin, sex, religion, age, disability, sexual orientation, gender identity, veteran status, height, weight, or marital status in employment or the provision of services and is an equal access/equal opportunity/affirmative action employer.

This job description is not intended to be an all-inclusive list of duties and standards of the position and will be reviewed periodically as duties and responsibilities change with business necessity. Essential job functions are subject to modification. Incumbents will follow any other instructions, and perform any other related duties, as assigned by their supervisor.