Cloud Cyber Security Engineer

Position Summary

Base-2 Solutions is seeking a Cloud Cyber Security Engineer to play a critical role in the accreditation of a state-of-the-art technology stack under the DOMEX Technology Platform (DTP), where the role supports the client's mission to centralize and standardize Tasking, Collection, Processing, Exploitation and Dissemination (TCPED) of Open Source Intelligence (OSINT) across the Defense and Intelligence Community enterprises. The role supports cloud-based computing, artificial intelligence (AI), machine learning (ML), and cross-domain transfer systems that provide cutting edge data exploitation, enrichment, triage, and analytics capabilities to the Defense Intelligence Enterprise. This is an on-site role in Bethesda, MD.

Essential Duties and Responsibilities

• Provide technical security expertise in securing, hardening, and maintaining compliance of cloud-based software platforms and infrastructure across multiple secure networks.
• Collaborate closely with compliance personnel, software engineers, system engineers, system architects, and Government counterparts to perform the full spectrum of systems and cyber security engineering tasks to ensure system regulatory compliance and security posture.
• Validate and verify system security requirements and establish system security designs for large-scale systems, major system elements, and interfacing systems that are part of a large complex network environment with geographically distributed components.
• Recommend and develop technical solutions, products, and standards based on current and desired system security architecture.
• Effectively collaborate with other internal technical experts on a day-to-day basis.
• Communicate with Program Managers and POCs from customer organizations when necessary, regarding Security issues of significant importance.
• Participate in Program Increment Planning and related agile team activities.
• Work closely with System Engineering, Test Engineering, and Integration teams to ensure that the hardware and software architecture and implementation meets security requirements.
• Evaluate the impact of new development on the operational security posture of the system.
• Serve as a subject matter expert in security architecture to include providing advice to Program Managers, Customer technical experts, and internal program teams.
• Continuously improve engineering processes, documentation standards, implementation playbooks, migration runbooks, technical standards, and execution models to accelerate delivery, reduce rework, improve operational handoff, and lower sustainment burden.
• Design security architectures and solutions spanning AWS, Azure, GCP, and OCI, identifying common architectural patterns while accounting for CSP-specific capabilities and limitations.
• Architect integrations between native security services and enterprise security platforms, including vulnerability management products, Stig evaluation, and SIEM.
• Design, engineer, and implement enterprise network security architecture spanning next-generation firewalls, intrusion detection and prevention, web and TLS proxies, VPN and encryption services, network access control, DNS security, and east-west security controls.
• Evaluate the current network security architecture, identify gaps and improvement opportunities, estimate level of effort, assess implementation risk, and develop practical engineering plans to strengthen enterprise security capabilities.
• Provide specifications for network security architecture, evaluate and recommend emerging security technologies, and perform needs assessments to inform design and investment decisions.
• Tune and optimize security controls to reduce false positives, close coverage gaps, and improve detection and enforcement without degrading network performance or availability.
• Monitor system security status, identify risks and vulnerabilities, and coordinate remediation efforts with system owners, engineers, and other stakeholders.

Required Qualifications

• Bachelor of Science degree from an accredited university ideally in Computer Science, Information Assurance, Information Security System Engineering or related field.
• Meet the applicable education and experience requirement in the Required Education and Experience Equivalency section.
• You will lean on your experience with security technologies, industry best practices, vulnerability management, and risk management frameworks (RMF) to employ effective security solutions.
• Must have a solid understanding of security practices and policies and hands-on vulnerability testing experience using Customer tools.
• Must have experience applying Risk Management Framework.
• Must have demonstrated knowledge of and experience with common security tools, such as ACAS, Prisma Cloud, and Splunk/Elastic.
• Experience with SCAP or STIG based tools and specifications.
• Extensive experience designing enterprise security solutions and translating security requirements into implementable technical architectures.
• Knowledge of Kubernetes and container security architectures, including image security, admission controls, secrets, identity, network policies, software supply chain security, security scanning, and runtime protection.
• Experience designing solutions involving SIEM, vulnerability management, identity security, network security, secrets management, container scanning, and data protection technologies.
• Experience with data modeling and mapping system data flows for the purpose of cybersecurity analysis.
• Understanding of microservices architecture and service mesh.

Preferred Qualifications

• Active TS/SCI with polygraph.
• Experience with Commercial Cloud Services (C2S) and cloud-based enterprise services, preferably AWS.
• Five (5) years of experience with Defense in Depth Principals/technology (including access control, authorization, identification and authentication, public key infrastructure, network and enterprise security architecture) and applying risk assessment methodology to system development.
• DoD 8570 compliance with IASAE Level 2 or 3.
• Experience installing, configuring, testing, deploying, operating, and maintaining enterprise network based scanning and reporting tools such as Trellix/ESS, ACAS, Evaluate STIG, SteelCloud ConfigOS, Prisma Cloud and STIG Manager.
• Extensive experience hardening modern operating systems, such as Oracle Linux and RHEL, as well as Microsoft Windows environments using Security Technical Implementation Guides (STIGs).
• Information Systems Security Engineering Professional (ISSEP) Certification.
• Computer Information Systems Security Professional (CISSP) Certification.
• Design and Architecture: Design, implement, and maintain Splunk environments including forwarders, indexers, search heads, and deployment servers.
• Hands-on experience with two or more of the following technologies: Palo Alto Prisma Cloud, Splunk, Elastic, or Evaluate Stig.

Required Education and Experience Equivalency

• Bachelor of Science degree from an accredited university ideally in Computer Science, Information Assurance, Information Security System Engineering or related field with minimum of 12 years of experience as an Information Systems Security Engineer (ISSE) or System Engineer on programs and/or contracts with the customer space.

Required Certifications

• At least one IAT and one IAT Level II or higher certification e.g., CCNA Security, CySA+, Security+ CE, CISSP (or Associate) and the ability to obtain Privileged User Account (PUA)/elevated access per DoD policy.

Required Security Clearance

• Active Top Secret/SCI
• Must obtain a CI polygraph after start; Top Secret/SCI required to start.
• U.S. citizenship is required

Equal Employment Opportunity

Base-2 Solutions is an equal opportunity employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex (including pregnancy), national origin, age, sexual orientation, gender identity, genetic information, protected veteran status, or any other characteristic protected by law, and will not be discriminated against on the basis of disability. Learn more: base-2solutions.com/eeo