Sr. Cybersecurity Engineer

POSITION DESCRIPTION

The Senior Cybersecurity Engineer designs, implements, and improves security controls that protect the organization's systems, cloud environments, networks, applications, AI-enabled services, and data. In partnership with the Manager, Cyber Security, this role defines technical security requirements and leads design reviews across security engineering, detection and response, security architecture, AI security, and operation of the Cybersecurity Maturity Model Certification (CMMC) enclave. It guides technical controls for employee AI use and internally developed AI workloads while supporting ongoing CMMC Level 2 and NIST SP 800-171 readiness with governance, risk, and compliance stakeholders.

What Your Work Could Look Like

Before a new application, cloud service, or AI-enabled workflow moves toward delivery, you would work with its owners to define the security requirements it must meet. You would use threat modeling and your knowledge of identity, sensitive data, logging, and incident response to shape a design that is secure and operable. You would lead the technical review, explain tradeoffs, and give engineering teams patterns they can implement and test.

For the CMMC enclave, you would work with governance, risk, and compliance, infrastructure, and system owners to translate control obligations into technical requirements and architecture. You would guide implementation, verify evidence, and identify gaps that need attention. As risks and competing needs emerge, you would bring the Cybersecurity Manager clear recommendations on technical priorities, dependencies, and decisions.

How We Work and Lead

• Set practical technical direction. We turn security risks and obligations into requirements, design patterns, and controls that other teams can use.

• Invite challenge and make evidence visible. We review designs with technical partners, test whether controls work, and revise our assumptions when the evidence calls for it.

• Build security capability across teams. We guide implementation, mentor technical colleagues, and give the Cybersecurity Manager candid recommendations on risks and priorities.

QUALIFICATIONS:

Required

• Bachelor’s degree in Cybersecurity, Information Security, Computer Science, Information Technology, Engineering, or a related field; equivalent experience may be considered.

• 4-7 years of progressive experience in cybersecurity engineering, security operations, infrastructure security, cloud security, or a related technical security role.

• Working knowledge of CMMC Level 2 and NIST SP 800-171 requirements, including CUI scoping, security control implementation, assessment evidence, POA&M remediation, and certification readiness activities.

Preferred

• 7+ years of progressive experience in cybersecurity engineering, security operations, infrastructure security, cloud security, or a related technical security role.

• Professional security certification such as CISSP, CISM, GIAC, GCIH, GCIA, Security+, Azure Security Engineer Associate, AWS Security Specialty, or equivalent.

• Experience with security frameworks and standards such as the NIST Cybersecurity Framework, NIST NICE Framework, CIS Controls, ISO 27001, or similar governance and control models.

• Experience leading AI security architecture, governance, or engineering for public AI services, developer copilots, or internally developed AI/ML workloads. Experience supporting a CMMC Level 2 assessment and CMMC-focused training or credentials such as CCP or CCA are preferred.

Skills

• Strong technical knowledge of SIEM, SOAR, EDR/XDR, vulnerability management, identity and access management, firewalls, IDS/IPS, endpoint security, cloud security controls, scripting or automation, threat detection, incident response, and secure system design.

• Demonstrated expertise in cloud and identity security, including identity governance, privileged access management, conditional access, Zero Trust principles, cloud security posture management, and Microsoft Entra ID or comparable platforms.

• Strong knowledge of AI application architecture, including model APIs, retrieval-augmented generation, vector databases, agents, tools, Model Context Protocol services, machine-to-machine access, and sensitive-data flows.

• Knowledge of secure software development practices, application security testing, API security, secrets management, threat modeling, and secure coding, with strong technical documentation, communication, prioritization, and project leadership skills.

RESPONSIBILITIES AND TASKS

Security Engineering and Control Operations

• Design, implement, maintain, and improve security controls across on-premises, cloud, network, endpoint, identity, application, and data environments.

• Engineer cloud and identity protections, including security posture management, identity governance, privileged access management, conditional access, Zero Trust controls, and Microsoft Entra ID or comparable platforms.

• Optimize security tools, configuration baselines, access controls, and automation; coordinate remediation when controls do not meet approved technical requirements.

• Detection, Vulnerability Management and Incident Response (15% of time)

• Lead vulnerability management, prioritize findings by risk and exposure, and coordinate remediation and validation with system owners.

• Improve threat detection and monitoring through log-source onboarding, detection rules, alert tuning, investigation workflows, and security automation.

• Serve as a senior technical resource during security incidents; support investigation, containment, recovery, lessons learned, and improvements to response playbooks.

AI Security Engineering

• Secure employee use of public AI services, developer copilots, and AI-enabled SaaS through identity-, device-, risk-, and data-aware controls.

• Design and implement protections for internally developed AI workloads, including model APIs, retrieval-augmented generation pipelines, vector databases, agents, Model Context Protocol services, tools, credentials, and machine-to-machine access.

• Work with application, AI/ML, and data governance teams to address sensitive-data flows, agent and tool permissions, source code and credential exposure, shadow AI, and identified AI security weaknesses.

• CMMC Enclave and Assessment Readiness (15% of time)

• Manage the technical security of the CMMC enclave, including controlled unclassified information (CUI) boundaries and data flows, in-scope assets, access and device controls, secure configurations, logging, monitoring, and vulnerability remediation.

• Implement applicable CMMC Level 2 and NIST SP 800-171 technical controls and maintain supporting evidence, system security plan inputs, control descriptions, and assessment-ready artifacts.

• Track technical gaps, POA&M remediation, access reviews, audit-log coverage, and assessment findings; partner with governance, risk, and compliance stakeholders on scope, assessment coordination, compliance determinations, and formal risk acceptance.

Security Architecture and Application Security

• Lead security architecture and design reviews for infrastructure, cloud services, applications, AI solutions, integrations, and major technology initiatives.

• Define technical security requirements for new and changing applications, cloud services, integrations, AI-enabled workflows, and infrastructure; guide owners in applying and verifying them.

• Develop reference architectures, secure design patterns, and technical guardrails; conduct threat modeling and recommend practical risk-reduction measures.

• Partner with development teams on secure software practices, application and API testing, secrets management, integration and vendor reviews, and remediation of security findings.

• Technical Leadership and Security Planning (10% of time)

• Guide and mentor security analysts, engineers, infrastructure teams, application teams, and AI/ML partners on technical controls and secure practices.

• Lead cross-functional technical work during incidents, audits, security reviews, projects, and implementation of cybersecurity and AI security initiatives.

• Contribute to security architecture and AI security roadmaps, control maturity plans, technology selection, and risk priorities; evaluate emerging threats and recommend improvements.

• Escalate material weaknesses and provide documented technical input for formal risk-acceptance decisions.

Standards, Procedures and Technical Documentation

• Develop and maintain security standards, procedures, configuration baselines, technical playbooks, and control implementation documentation.

• Maintain AI security standards for sanctioned use, sensitive-data handling, model and API access, agent and tool permissions, exceptions, and protection of source code, credentials, intellectual property, and customer information.

• Document CMMC enclave configurations, evidence, exceptions, and technical remediation status in coordination with governance, risk, and compliance stakeholders.

Measurement and Reporting

• Define and report measures of vulnerability remediation, detection and response coverage, AI policy effectiveness, control performance, incidents, exceptions, and audit-finding closure.

• Report CMMC enclave readiness, including control status, evidence completeness, access reviews, audit-log coverage, assessment findings, POA&M progress, and risks to ongoing compliance.

• Use trends and findings to recommend and track improvements to the organization’s security posture.

Additional Responsibilities

• Participate in special projects, emergency response activities, business continuity exercises, vendor reviews, and other cybersecurity or AI security initiatives as needed.

• Maintain current knowledge of cybersecurity and AI security threats, tools, techniques, and practices through training, research, industry engagement, and hands-on technical learning.

OFFICE AND TRAVEL

• Work is typically performed in an office or hybrid environment using standard business and technical security tools.

• Occasional travel may be required for business continuity exercises, audits, conferences, vendor meetings, incident response activities, or organizational meetings.

An Invitation to Apply

If you are the engineer others turn to when security requirements are unclear or a design carries real risk, we would like to hear from you. Show us how you have defined technical standards, guided partners without direct authority, and made controls work in production. Bring your working knowledge of CMMC requirements and your perspective on securing emerging AI uses alongside established systems.

PHYSICAL REQUIREMENTS

The physical requirements listed here are representative of those that must be met by an employee to successfully perform the essential functions of this job. Reasonable accommodations may be made to enable individuals with disabilities to perform the essential functions.

Position involves sitting for extended periods of time at employee’s workstation and during meetings as well as while traveling, either by plane or car. Employee needs to be able to lift to 20 pounds as frequently as needed to move objects; dexterity to write and manipulate computer keyboard and mouse; ability to hear and speak clearly; and ability to distinguish between colors on graphs and charts.

Occasionally, employee will be required to visit construction jobsites which may expose the employee to dirt, dust, uneven surfaces, outdoor weather conditions and extreme temperatures.

***

In alignment with our commitment to pay transparency, the base salary range for this position is $130,000 to $170,000, excluding fringe benefits or potential bonuses. If you join McGough, your final base salary will be determined by several factors, including geography, location, skills, education, and experience. Furthermore, we place significant value on pay equity among our current team members as part of any final job offer.

Please note that the range provided above reflects the hiring range for this role. Hiring near the top end of this range would be atypical, as we aim to allow room for future salary growth. Additionally, McGough offers a comprehensive compensation and benefits package. This includes insurance coverage for medical, dental, vision, life, and disability. We also provide generous retirement plans, voluntary benefit plans, parental leave, substantial paid time off, and holiday pay.