{"id":2648272,"url":"https://alion.io/job/bixal-security-engineer","title":"Security Engineer","company":{"id":2378363,"name":"Bixal","domain":"bixal.com","url":"https://alion.io/company/bixal","size_band":null,"is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Schema","truth_index":null},"role":"Security","role_family":"Security","seniority":"senior","employment_type":"full_time","work_mode":"remote","remote_scope":"stated_countries","remote_scope_basis":"posting_text","remote_working_hours":null,"hiring_geo_confidence":"explicit","locations":["United States"],"countries":["US"],"hiring_countries":["US"],"hiring_countries_total":1,"salary":{"min":130000,"max":140000,"currency":"USD","period":"year","gross":null,"usd_annual":140000},"salary_estimate":null,"experience_years_min":5,"visa_sponsorship":true,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Apache HTTP Server","optional":false},{"name":"Apache Tomcat","optional":false},{"name":"CI/CD","optional":false},{"name":"Java","optional":false},{"name":"Linux","optional":false},{"name":"Nessus","optional":false},{"name":"Oracle","optional":false},{"name":"OWASP","optional":false},{"name":"OWASP ASVS","optional":false},{"name":"OWASP Top 10","optional":false},{"name":"OWASP ZAP","optional":false},{"name":"Qualys Cloud Platform","optional":false},{"name":"Red Hat","optional":false},{"name":"Snyk","optional":false},{"name":"Threat Modeling","optional":false},{"name":"Zero Trust","optional":false},{"name":"AWS","optional":true},{"name":"Docker","optional":true},{"name":"Grafana","optional":true},{"name":"Kubernetes","optional":true},{"name":"Loki","optional":true},{"name":"Prometheus","optional":true},{"name":"Splunk","optional":true}],"status":"live","first_seen_at":"2026-10-15T13:43:18Z","employer_posted_date":"2026-10-15","last_verified_at":"2026-10-16T05:31:06Z","board_verified":true,"closed_at":null,"days_open":0,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":0},"description":"Important Notice for Applicants:\nAt Bixal, we want to ensure a transparent and secure application process for all candidates. Official communication will come from an email address ending in @bixal.com or from @bixal.na.teamtailor-mail.com. Messages from other sources may be fraudulent, and you should exercise care to avoid any links or attachments included.\nBixal will ensure that individuals with disabilities are provided reasonable accommodation to participate in the job application or interview process, to perform essential job functions, and to receive other benefits and privileges of employment.\nNeed Assistance or a Reasonable Accommodation?\n If you need assistance or a reasonable accommodation to complete your application, we're here to help. Please reach out to us at  and let us know how we can support you. You do not need to share personal details or disclose the nature of your request. You can expect a response from a team member within 24 hours during the regular work week and on the next operating day during the weekend or holidays.\nWhy Bixal?\nBixal is a consulting company headquartered in Fairfax, VA, working alongside governments and organizations to help them deliver better services and experiences to the communities they serve. Using evidence-based knowledge and technology, Bixal empowers clients to deliver on their missions more effectively by fostering a culture of learning and continuous improvement.\nOur values:\nPeople-First: Emphasizing the importance of people in all aspects of work.\n\nCollaboration and Transparency: Valuing teamwork and open communication.\n\nGrowth Mindset: Encouraging innovation and continuous improvement.\n\nCreating Lasting Impact: Focusing on meaningful outcomes and positive change.\n\nAbout the role:\nBixal is seeking a Security Engineer to serve as security lead for a FIPS 199 Moderate federal platform that supports governmentwide regulatory planning and review. Federal agencies, oversight offices, and the public rely on these systems, which must stay available 24/7/365 while a modern replacement is built alongside them.\nYou will protect both. On the legacy side, you will keep a Java, Oracle, and Red Hat environment hardened, patched, and compliant. On the modernization side, you will build security into a new cloud-based platform from day one so it is ready for an Authority to Operate (ATO) when it reaches production. Because work can shift between the two, we're looking for someone comfortable moving between sustaining an existing system and securing a new one.\nThis is a client-facing role. You will be the program's named security lead, working with the client's technical leads, our Project Manager, and the engineering team, and translating security requirements into practical decisions that keep delivery moving.\nThis is a full-time position on an awarded contract with a 12-month base period and two 12-month option periods. This role offers you a unique opportunity to make a meaningful impact on a project that aligns with Bixal’s mission of delivering innovative, human-centered solutions. While the role has a fixed duration, we are committed to transparency and collaboration, keeping you informed about contract updates and new opportunities. At Bixal, we support your professional journey, ensuring your experience reflects our inclusive, purpose-driven culture and prepares you for future success.\nLocation\nThis role can work remotely from anywhere in the USA. You must be legally authorized to work in the US. Bixal does not provide visa sponsorship.\nCompensation:\nThe salary range for this role is $130,000 - $140,000. In the spirit of transparency, most offers tend to land near the midpoint of the range. We make compensation decisions thoughtfully, considering your experience, the skills you bring, and our commitment to internal equity. Fairness and transparency are core to how we operate.\nResponsibilities:\nVulnerability Management & Security Operations\nRun automated vulnerability scans of operating systems, databases, and web applications, and lead remediation and patching across Red Hat Enterprise Linux, Oracle, Apache/Tomcat, and Java application components.\n\nMeet contractual remediation timelines for scan and penetration test findings (15 days for critical, 30 for high, 60 for medium, 120 for low), and document Plans of Action and Milestones (POA&Ms) when a timeline cannot be met.\n\nHarden systems against GSA security benchmarks and CIS Level 1 guidelines.\n\nTrack end-of-life software, unsupported libraries, and known vulnerabilities, and raise risks early with a recommended path forward.\n\nSupport continuous monitoring, log review, and incident response in line with NIST SP 800-61.\n\nSupport continuity of operations (COOP) and disaster recovery planning and testing.\n\nCompliance, Assessment & Authorization\nMaintain the system's assessment and authorization (A&A) package under NIST SP 800-37 and SP 800-53 Rev. 5, including the System Security and Privacy Plan, contingency plan, business impact analysis, incident response plan, and contingency plan test report.\n\nMaintain POA&Ms and support Government-led security assessments, control reviews, and penetration testing.\n\nSupport privacy compliance artifacts such as Privacy Threshold Assessments and Privacy Impact Assessments.\n\nKeep security documentation current as legacy capabilities are replaced and retired.\n\nSecure Development & Modernization\nPerform threat modeling for new features, integrations, and architecture decisions.\n\nEmbed static and dynamic security testing (such as Snyk and OWASP ZAP) in CI/CD pipelines so every release meets OWASP ASVS with no unresolved medium or high findings.\n\nReview releases for security impact before production, protecting availability.\n\nAdvise on secure architecture for the modernized platform, including federated identity, FIPS 140-validated encryption, Zero Trust principles, and software supply chain security.\n\nPrepare security packages for prototype testing and position the new platform to receive an ATO at production deployment.\n\nAdvisory & Client Partnership\nProvide guidance on public key infrastructure, firewall and network security, internet protocols, and configuration management.\n\nServe as the client's security point of contact, briefing technical leads and the Project Manager on risks, findings, and remediation progress.\n\nCoordinate with client IT teams on infrastructure changes and validate system security after those changes.\n\nOther relevant duties as assigned and qualified/trained to perform.\n\nQualifications:\nBachelor's degree in Cybersecurity, Computer Science, Information Systems, or a related field.\n\nAt least 5 years of hands-on information security experience, including securing federal information systems under FISMA.\n\nHands-on experience with the NIST Risk Management Framework, including implementing and assessing NIST SP 800-53 Rev. 5 controls at the Moderate baseline.\n\nExperience writing and maintaining A&A documentation, including System Security Plans, contingency plans, incident response plans, and POA&Ms, and supporting a system through ATO.\n\nExperience running vulnerability scanning tools (such as Tenable/Nessus or Qualys) and driving remediation across operating system, database, and web application layers.\n\nExperience hardening Linux (preferably Red Hat Enterprise Linux) servers and relational databases (preferably Oracle) against CIS or agency benchmarks.\n\nWorking knowledge of application security, including the OWASP Top 10 and ASVS, static and dynamic testing tools, and securing CI/CD pipelines.\n\nFamiliarity with public key infrastructure, TLS certificate management, firewall configuration, and network protocols.\n\nClear, confident communication skills, with the ability to explain risk and trade-offs to technical and non-technical stakeholders, including client leadership.\n\nThis position requires the ability to obtain and maintain a favorable Public Trust determination in support of a federal government contract.\n\nNice to Have Skills and Experience:\nSecurity certifications such as CISSP, CISM, CompTIA Security+, or equivalent.\n\nExperience with GSA IT security policies, procedural guides, or the GSA ATO process.\n\nExperience securing cloud-hosted or containerized platforms (AWS, cloud.gov, Docker, Kubernetes).\n\nFamiliarity with Zero Trust architecture (OMB M-22-09) and secure software development practices (NIST SSDF, OMB M-22-18).\n\nExperience with identity federation and single sign-on, including Login.gov.\n\nExperience with monitoring and logging tools such as Grafana, Prometheus, Loki, or Splunk.\n\nExperience supporting systems through a legacy-to-modern platform migration.\n\nHow We Support Our Team:\nFlex hours\n\n401K with matching incentive\n\nParental Leave\n\nMedical/dental/vision benefits\n\nFlex Spending Account\n\nCompany provided short-term disability and life insurance\n\nCommuter benefits\n\nPaid Time Off (PTO)\n\n11 Paid holidays\n\nOur company is committed to providing equal employment opportunities for all individuals and complies with all applicable federal, state, and local anti-discrimination laws. Employment decisions are based on merit, qualifications, and business needs.","description_format":"text","description_chars":9207,"description_truncated":false,"requirements":{"experience_years_min":5,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":false,"languages":[]},"benefits":["401k plan","Equity","Life insurance","Parental leave"],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Digital Government","Custom Software Development"],"lifecycle":[{"event":"open","at":"2026-10-15T20:48:27Z"}],"visa":[],"liveness":{"score":80,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.8,"p_room":1,"age_days":0,"expected_fill_days":2,"reasons":["conf:0","velocity","win:early"],"computed_at":"2026-10-16T05:45:00Z"},"pay":{"stated_usd_annual":140000,"is_top_pay":false},"html_url":"https://alion.io/job/bixal-security-engineer","json_url":"https://alion.io/job/bixal-security-engineer.json","meta":{"generated_at":"2026-10-16T07:44:26Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":5621,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-17T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":2378363},"rest":"https://alion.io/mcp/rest/get_company?id=2378363"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fbixal-security-engineer"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fbixal-security-engineer"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fbixal-security-engineer"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/bixal-security-engineer\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fbixal-security-engineer"}]}