{"id":4145287,"url":"https://alion.io/job/mcgough-sr-cybersecurity-engineer","title":"Sr. Cybersecurity Engineer","company":{"id":2002605,"name":"McGough","domain":"mcgough.com","url":"https://alion.io/company/mcgough","size_band":"1001-5000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Workday","truth_index":{"grade":"A","score":100,"open_postings":7,"ghost_share":0,"stale_share":0,"repost_share":0,"time_to_fill_p50_days":17,"computed_at":"2026-11-12T10:38:37Z"}},"role":"Security","role_family":"Security","seniority":"senior","employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Roseville, United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":{"min":130000,"max":170000,"currency":"USD","period":"year","gross":null,"usd_annual":170000},"salary_estimate":null,"experience_years_min":7,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AWS","optional":false},{"name":"Azure","optional":false},{"name":"CMMC","optional":false},{"name":"ISO 27001","optional":false},{"name":"Microsoft Entra ID","optional":false},{"name":"Model Context Protocol","optional":false},{"name":"RAG","optional":false},{"name":"SIEM","optional":false},{"name":"Threat Modeling","optional":false},{"name":"Zero Trust","optional":false}],"status":"live","first_seen_at":"2026-11-11T00:00:00Z","employer_posted_date":"2026-11-11","last_verified_at":"2026-11-12T06:48:51Z","board_verified":true,"closed_at":null,"days_open":1,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":1},"description":"POSITION DESCRIPTION\nThe Senior Cybersecurity Engineer designs, implements, and improves security controls that protect the organization's systems, cloud environments, networks, applications, AI-enabled services, and data. In partnership with the Manager, Cyber Security, this role defines technical security requirements and leads design reviews across security engineering, detection and response, security architecture, AI security, and operation of the Cybersecurity Maturity Model Certification (CMMC) enclave. It guides technical controls for employee AI use and internally developed AI workloads while supporting ongoing CMMC Level 2 and NIST SP 800-171 readiness with governance, risk, and compliance stakeholders.\nWhat Your Work Could Look Like\nBefore a new application, cloud service, or AI-enabled workflow moves toward delivery, you would work with its owners to define the security requirements it must meet. You would use threat modeling and your knowledge of identity, sensitive data, logging, and incident response to shape a design that is secure and operable. You would lead the technical review, explain tradeoffs, and give engineering teams patterns they can implement and test.\nFor the CMMC enclave, you would work with governance, risk, and compliance, infrastructure, and system owners to translate control obligations into technical requirements and architecture. You would guide implementation, verify evidence, and identify gaps that need attention. As risks and competing needs emerge, you would bring the Cybersecurity Manager clear recommendations on technical priorities, dependencies, and decisions.\nHow We Work and Lead\nSet practical technical direction. We turn security risks and obligations into requirements, design patterns, and controls that other teams can use.\nInvite challenge and make evidence visible. We review designs with technical partners, test whether controls work, and revise our assumptions when the evidence calls for it.\nBuild security capability across teams. We guide implementation, mentor technical colleagues, and give the Cybersecurity Manager candid recommendations on risks and priorities.\nQUALIFICATIONS:\nRequired\nBachelor’s degree in Cybersecurity, Information Security, Computer Science, Information Technology, Engineering, or a related field; equivalent experience may be considered.\n4-7 years of progressive experience in cybersecurity engineering, security operations, infrastructure security, cloud security, or a related technical security role.\nWorking knowledge of CMMC Level 2 and NIST SP 800-171 requirements, including CUI scoping, security control implementation, assessment evidence, POA&M remediation, and certification readiness activities.\nPreferred\n7+ years of progressive experience in cybersecurity engineering, security operations, infrastructure security, cloud security, or a related technical security role.\nProfessional security certification such as CISSP, CISM, GIAC, GCIH, GCIA, Security+, Azure Security Engineer Associate, AWS Security Specialty, or equivalent.\nExperience with security frameworks and standards such as the NIST Cybersecurity Framework, NIST NICE Framework, CIS Controls, ISO 27001, or similar governance and control models.\nExperience leading AI security architecture, governance, or engineering for public AI services, developer copilots, or internally developed AI/ML workloads. Experience supporting a CMMC Level 2 assessment and CMMC-focused training or credentials such as CCP or CCA are preferred.\nSkills\nStrong technical knowledge of SIEM, SOAR, EDR/XDR, vulnerability management, identity and access management, firewalls, IDS/IPS, endpoint security, cloud security controls, scripting or automation, threat detection, incident response, and secure system design.\nDemonstrated expertise in cloud and identity security, including identity governance, privileged access management, conditional access, Zero Trust principles, cloud security posture management, and Microsoft Entra ID or comparable platforms.\nStrong knowledge of AI application architecture, including model APIs, retrieval-augmented generation, vector databases, agents, tools, Model Context Protocol services, machine-to-machine access, and sensitive-data flows.\nKnowledge of secure software development practices, application security testing, API security, secrets management, threat modeling, and secure coding, with strong technical documentation, communication, prioritization, and project leadership skills.\nRESPONSIBILITIES AND TASKS\nSecurity Engineering and Control Operations\nDesign, implement, maintain, and improve security controls across on-premises, cloud, network, endpoint, identity, application, and data environments.\nEngineer cloud and identity protections, including security posture management, identity governance, privileged access management, conditional access, Zero Trust controls, and Microsoft Entra ID or comparable platforms.\nOptimize security tools, configuration baselines, access controls, and automation; coordinate remediation when controls do not meet approved technical requirements.\nDetection, Vulnerability Management and Incident Response (15% of time)\nLead vulnerability management, prioritize findings by risk and exposure, and coordinate remediation and validation with system owners.\nImprove threat detection and monitoring through log-source onboarding, detection rules, alert tuning, investigation workflows, and security automation.\nServe as a senior technical resource during security incidents; support investigation, containment, recovery, lessons learned, and improvements to response playbooks.\nAI Security Engineering\nSecure employee use of public AI services, developer copilots, and AI-enabled SaaS through identity-, device-, risk-, and data-aware controls.\nDesign and implement protections for internally developed AI workloads, including model APIs, retrieval-augmented generation pipelines, vector databases, agents, Model Context Protocol services, tools, credentials, and machine-to-machine access.\nWork with application, AI/ML, and data governance teams to address sensitive-data flows, agent and tool permissions, source code and credential exposure, shadow AI, and identified AI security weaknesses.\nCMMC Enclave and Assessment Readiness (15% of time)\nManage the technical security of the CMMC enclave, including controlled unclassified information (CUI) boundaries and data flows, in-scope assets, access and device controls, secure configurations, logging, monitoring, and vulnerability remediation.\nImplement applicable CMMC Level 2 and NIST SP 800-171 technical controls and maintain supporting evidence, system security plan inputs, control descriptions, and assessment-ready artifacts.\nTrack technical gaps, POA&M remediation, access reviews, audit-log coverage, and assessment findings; partner with governance, risk, and compliance stakeholders on scope, assessment coordination, compliance determinations, and formal risk acceptance.\nSecurity Architecture and Application Security\nLead security architecture and design reviews for infrastructure, cloud services, applications, AI solutions, integrations, and major technology initiatives.\nDefine technical security requirements for new and changing applications, cloud services, integrations, AI-enabled workflows, and infrastructure; guide owners in applying and verifying them.\nDevelop reference architectures, secure design patterns, and technical guardrails; conduct threat modeling and recommend practical risk-reduction measures.\nPartner with development teams on secure software practices, application and API testing, secrets management, integration and vendor reviews, and remediation of security findings.\nTechnical Leadership and Security Planning (10% of time)\nGuide and mentor security analysts, engineers, infrastructure teams, application teams, and AI/ML partners on technical controls and secure practices.\nLead cross-functional technical work during incidents, audits, security reviews, projects, and implementation of cybersecurity and AI security initiatives.\nContribute to security architecture and AI security roadmaps, control maturity plans, technology selection, and risk priorities; evaluate emerging threats and recommend improvements.\nEscalate material weaknesses and provide documented technical input for formal risk-acceptance decisions.\nStandards, Procedures and Technical Documentation\nDevelop and maintain security standards, procedures, configuration baselines, technical playbooks, and control implementation documentation.\nMaintain AI security standards for sanctioned use, sensitive-data handling, model and API access, agent and tool permissions, exceptions, and protection of source code, credentials, intellectual property, and customer information.\nDocument CMMC enclave configurations, evidence, exceptions, and technical remediation status in coordination with governance, risk, and compliance stakeholders.\nMeasurement and Reporting\nDefine and report measures of vulnerability remediation, detection and response coverage, AI policy effectiveness, control performance, incidents, exceptions, and audit-finding closure.\nReport CMMC enclave readiness, including control status, evidence completeness, access reviews, audit-log coverage, assessment findings, POA&M progress, and risks to ongoing compliance.\nUse trends and findings to recommend and track improvements to the organization’s security posture.\nAdditional Responsibilities\nParticipate in special projects, emergency response activities, business continuity exercises, vendor reviews, and other cybersecurity or AI security initiatives as needed.\nMaintain current knowledge of cybersecurity and AI security threats, tools, techniques, and practices through training, research, industry engagement, and hands-on technical learning.\nOFFICE AND TRAVEL\nWork is typically performed in an office or hybrid environment using standard business and technical security tools.\nOccasional travel may be required for business continuity exercises, audits, conferences, vendor meetings, incident response activities, or organizational meetings.\nAn Invitation to Apply\nIf you are the engineer others turn to when security requirements are unclear or a design carries real risk, we would like to hear from you. Show us how you have defined technical standards, guided partners without direct authority, and made controls work in production. Bring your working knowledge of CMMC requirements and your perspective on securing emerging AI uses alongside established systems.\nPHYSICAL REQUIREMENTS\nThe physical requirements listed here are representative of those that must be met by an employee to successfully perform the essential functions of this job. Reasonable accommodations may be made to enable individuals with disabilities to perform the essential functions.\nPosition involves sitting for extended periods of time at employee’s workstation and during meetings as well as while traveling, either by plane or car. Employee needs to be able to lift to 20 pounds as frequently as needed to move objects; dexterity to write and manipulate computer keyboard and mouse; ability to hear and speak clearly; and ability to distinguish between colors on graphs and charts.\nOccasionally, employee will be required to visit construction jobsites which may expose the employee to dirt, dust, uneven surfaces, outdoor weather conditions and extreme temperatures.\n***\nIn alignment with our commitment to pay transparency, the base salary range for this position is $130,000 to $170,000, excluding fringe benefits or potential bonuses. If you join McGough, your final base salary will be determined by several factors, including geography, location, skills, education, and experience. Furthermore, we place significant value on pay equity among our current team members as part of any final job offer.\nPlease note that the range provided above reflects the hiring range for this role. Hiring near the top end of t...","description_format":"text","description_chars":12370,"description_truncated":true,"requirements":{"experience_years_min":7,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":false,"languages":[]},"benefits":["Equity","Insurance coverage","Parental leave","Retirement plans"],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Cybersecurity","Information Security","Property Development","Construction"],"lifecycle":[{"event":"open","at":"2026-11-12T06:48:51Z"}],"visa":[],"liveness":{"score":86,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.86,"p_room":1,"age_days":1,"expected_fill_days":17,"reasons":["conf:3","win:early","comp:brand"],"computed_at":"2026-11-12T10:38:37Z"},"pay":{"stated_usd_annual":170000,"is_top_pay":true},"html_url":"https://alion.io/job/mcgough-sr-cybersecurity-engineer","json_url":"https://alion.io/job/mcgough-sr-cybersecurity-engineer.json","meta":{"generated_at":"2026-11-12T10:59:25Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":22470,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-13T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.1,"usd":0.01,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":2002605},"rest":"https://alion.io/mcp/rest/get_company?id=2002605"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fmcgough-sr-cybersecurity-engineer"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":2,"usd":0.2},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fmcgough-sr-cybersecurity-engineer"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.1,"usd":0.01},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fmcgough-sr-cybersecurity-engineer"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/mcgough-sr-cybersecurity-engineer\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fmcgough-sr-cybersecurity-engineer"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":4145287}},{"tool":"search_jobs","arguments":{"company":"mcgough.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":4145287},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}