Cybersecurity Tools Engineer

Position Description:

ASRC Federal is actively hiring a Cybersecurity Tools Engineer in support of our Defense Counterintelligence Security Agency (DCSA) program based out of Fort Meade, MD.

We are seeking a skilled and experienced Cybersecurity Tools Engineer to work in our cloud security engineering team and with our on-premises team. The ideal candidate will serve as a technical resource for cybersecurity tools, platforms, and frameworks, responsible for helping to define and enhance cloud-wide and/or organization-wide security systems that protect critical assets, data, and systems across complex, hybrid, and multi-cloud environments.

This role requires expertise in selecting, integrating, and optimizing advanced cybersecurity tools including SIEM/SOAR platforms, firewalls, endpoint detection and response (EDR) solutions, and other security technologies. The Cybersecurity Tools Engineer will recommend tools, support successful implementation, and assist incident response and threat analysis teams. The role ensures compliance with federal regulations and industry frameworks throughout the complete lifecycle of security systems from acquisition through modernization.

This is primarily a Telework position with a requirement to be onsite at least one (1) day a week or as needed at Fort Meade, MD. Additional onsite time may be required during initial onboarding and program integration.

We invest in the lives of our employees, both in and out of the workplace, by providing competitive pay and benefit packages. This position is offering a pay range of $140,000.00 - $156,764.00 depending on experience, seniority, geographic locations, and factors permitted by law. Benefits offered may include health care, dental, vision, life insurance; 401k; education assistance; paid time off including Paid Time Off, holidays and any other paid leave required by law.

Minimum Requirements: 

Minimum of 5 years of hands-on experience cybersecurity architecture and engineering with at least 2 years of hands-on experience implementing enterprise security tools and platforms in large-scale, complex environments

Active Secret Clearance REQUIRED, eligible to be upgraded to TS/SCI

Must meet 8570 certification requirements at the time of hire.  IAT Level II (e.g., Security+ CE, CCNA Security, CySA+, GICSP, GSEC, SCCP or higher tiered 8570 certification

Degree in Cybersecurity, Computer Science, Information Systems Management, or a related field. An equivalent combination of military service and/or at least (4) years of significant, relevant work experience may be considered in lieu of degree requirement.

Required Technical Expertise:

SIEM/SOAR Platforms: Engineering experience with enterprise SIEM solutions (Elastic, Splunk, LogRhythm, etc.) and SOAR platforms (Swimlane or similar).

Endpoint Security: Knowledge of EDR/XDR solutions (CrowdStrike, Microsoft Defender for Endpoint, Trellix, etc.).

Security Scanning & Vulnerability Management: Experience with tools such as Nessus, Rapid7, Tenable, Qualys, or BurpSuite.

Cloud Security: Knowledge of AWS cloud environments (EC2, Lambda, S3) and cloud-native security tools (AWS Security Hub, Azure Security Center, GCP Security Command Center); CASB solutions a plus.

Network Security: Experience with next-generation firewalls (Palo Alto, Fortinet, Cisco Firepower), IDS/IPS, WAF, and NAC is a plus.

Compliance Frameworks: Understanding of NIST CSF, NIST RMF/800-53, FISMA, FedRAMP, CMMC, DFARS, ISO 27001/27002, and DoD STIGs. Experience with SA&A and ATO processes a plus.

Additional Skills: Scripting/automation (Python, PowerShell, Bash); Infrastructure as Code (Terraform, Ansible, CloudFormation); DevSecOps and CI/CD security; containerization (Docker, Kubernetes) a plus.

Responsibilities:

Tool Integration and Platform Management

Help lead the selection, evaluation, testing, and integration of enterprise security software, SIEM/SOAR platforms, firewalls, endpoint defenses, and other cybersecurity tools. Respond to customer queries and make recommendations for tools and solutions.

Implement comprehensive integration strategies for seamless interoperability between security tools and enterprise systems; engineer data flows and correlation rules for effective threat detection and response.

Develop and maintain security tool roadmaps; optimize configurations for effectiveness, performance, and cost efficiency; support governance frameworks including change management.

Framework Design and Architecture

Implement comprehensive security strategies addressing hybrid environments to ensure consistent security posture across platforms.

Review system architectures and design patterns for secure application deployment, data protection, and infrastructure hardening; apply best practices for cloud-native, IoT, and edge computing.

Maintain resilient security engineering supporting business continuity, disaster recovery, and high availability; establish security engineering principles and standards.

Risk Management and Compliance

Align security architectures with regulatory mandates including NIST RMF, FISMA, FedRAMP, CMMC, ISO 27001, and DoD STIGs.

Support security assessments, architecture reviews, audits, threat modeling, vulnerability analysis, and impact assessments.

Prepare artifacts for security authorization packages and ATO processes; assist with remediation plans, compensating controls, and POAMs.

Lifecycle Management

Develop security requirements and evaluation criteria for technology acquisitions and vendor selections.

Plan and execute security tool upgrades, migrations, and modernization with minimal operational impact; establish decommissioning procedures for secure data disposal.

Manage technical debt and strategies for legacy system security enhancement or replacement.

Policy, Standards, and Governance

Use and help develop comprehensive security policies, standards, procedures, and guidelines; maintain security baselines and hardening guides.

Define security metrics, KPIs, and KRIs; ensure policies align with federal regulations, industry frameworks, and organizational risk tolerance.

Technical Leadership and Innovation

Serve as SME and technical authority for cybersecurity engineering and security tools; provide advanced troubleshooting for complex integration and operational issues.

Lead proof-of-concept initiatives for emerging security technologies; mentor junior security architects, engineers, and analysts.

Present complex security engineering solutions and recommendations to senior leadership, technical teams, and stakeholders.

Work Environment and Physical Demands:

This is primarily a Telework position with a requirement to be onsite at least one (1) day a week at Fort Meade, MD (or additional days as required by the customer).

If alternate worksite is other than DCSA facilities or corporate office space, must have reliable ability to communicate over voice (cell phone preferred) and stable, capable internet connection.

Must be able to communicate complex technical solutions, security concepts, and risk assessments to diverse audiences, including senior leadership, both verbally and in written form.

May require occasional travel to other DCSA locations, vendor sites, or for training purposes (estimated <10%).

Must be able to work flexible hours to support critical security incidents, maintenance windows, and emergency response activities as needed; ability to participate in on-call rotation for critical security engineering support.