Security Engineer

Job Title: Security Engineer

Location: Remote

Employment Type: Full-time

Job Summary

The Security Engineer will support the security posture and Assessment & Authorization (A&A) program of the CMS Health Insurance Oversight System (HIOS) Platform Team, working within a complex federal production environment subject to formal ATO, change-control, and release-approval processes. This individual will safeguard cloud infrastructure and sensitive data by designing, implementing, and maintaining security controls, automating security workflows, and ensuring compliance with CMS and industry security standards, including the NIST 800-53 Risk Management Framework (RMF), FIPS, and FISMA guidance. The role blends hands-on security engineering (security testing, risk identification, threat modeling, remediation management, monitoring and detection) with daily security risk and compliance consulting (documentation, control assessments, audit support) and with the CI/CD pipeline, working alongside DevOps/Cloud Engineers, Security Leadership, and the client CISO to embed security into deployment automation without disrupting ongoing operations.

Key Activities

The Security Engineer will work as part of a cross-functional Agile team and is expected to:

• Perform security testing regularly on software releases and upgrades to ensure security posture.
• Design, implement, and maintain security solutions, controls, and security boundaries/architectures for cloud infrastructure, applications, and sensitive data.
• Analyze, design, code, and test components of automated deployment pipelines, and troubleshoot issues across the CI/CD pipeline (Jenkins, Ansible, Terraform) and Dev/Test/Staging/Production promotion processes, with security embedded throughout.
• Identify, assess, and mitigate security risks through threat modeling exercises, application security code reviews, and vulnerability analysis.
• Serve as liaison between development teams and stakeholders to document audit and security requirements, conduct technical and functional walkthroughs, and perform control self-assessments in support of ATO.
• Create and maintain Assessment and Authorization (A&A) documentation (system security plans, security risk assessments, security test and evaluation plans) and assemble ATO packages for hosted applications; support and lead third-party audits and security assessments.
• Develop and track Plans of Action and Milestones (POA&Ms), monitor compliance with cybersecurity policy, and mitigate non-compliant security controls.
• Automate security control workflows, including secure API key generation, storage, rotation, and certificate and access management.
• Evaluate overall risk using monitoring and detection tools (Splunk, New Relic, SIEM, firewall, system, application, native CSP, and vulnerability scanning platforms), and support system scanning and rapid incident response.
• Execute data classification and security assessments for client and program data, and research emerging security threats and technologies.
• Develop, maintain, and enforce security policies, standards, guidelines, and governance documentation for CD operations, developers, and infrastructure/O&M teams.
• Continuously mature the security and privacy program and facilitate ATO renewal year over year, working directly with Security Leadership and the client CISO on the functional, technical, and operational controls.
• Use Jira to manage security tasks and remediation status, collaborate with product owners, developers, architects, DevOps engineers, and the COR/GTL on security requirements and risk decisions, and provide client and executive status reporting.
• Participate in Agile and Scaled Agile Framework activities, including backlog refinement, sprint planning, daily stand-ups, demonstrations, retrospectives, and Program Increment planning.
• Follow CMS security, accessibility, documentation, configuration management, and software development lifecycle requirements.
• Provide technical guidance and security knowledge sharing to other team members as appropriate.

Required Qualifications

Education and Experience

· A bachelor's degree in a relevant area

· 3+ years of relevant experience across compliance, identity management, networking, systems, and cloud security

· Working knowledge of the NIST 800-53 Risk Management Framework (RMF) and Assessment and Authorization (A&A)/ATO processes, including POA&M management.

· Hands-on exposure to AWS, Ansible, Jenkins, Terraform, Okta, Linux, and frameworks such as MITRE ATT&ck; and knowledge of an artifact repository system (e.g., CSAM, Xacta, eMASS, CFACTS).

· Strong communication, documentation, and interpersonal skills are important, as the Security Engineer will need to balance security rigor with delivery velocity and production stability while serving as a liaison to stakeholders and client leadership.

· Prior experience with SAST using tools such as Fortify, SNYK SAST

· Prior experience with DAST using tools such as Burp Suite, Kali Linux, OWASP ZAP, SQL Map

· Prior experience with software composition analysis using tools such as SNYK SCA

· Other security tools such as TruffleHog

Preferred Qualifications

• Prior experience supporting security operations on a federal program, including working within formal ATO, change-control, and release-approval processes; familiarity with FIPS and FISMA guidance and Zero Trust Architecture;
• Scripting skills
• Red teaming or penetration testing experience
• Hack-the-Box or Capture-the-Flag participation
• CISSP, CCSP, CompTIA Security+, Cloud Security certificate (any CSP), CISA, CCNA, CEH, or other security/network certifications.

About Tech2i

Company is a woman-owned 8(a) certified small business, specializing in providing information technology services to both federal and commercial partners. With a demonstrated history of effectively implementing large-scale data solutions, streamlined cloud solutions, and fit-for-purpose Salesforce solutions, we lead with integrity in all our endeavors. Our agile and practical program management practices ensure successful implementations for our partners. We are driven by a passion for building technology solutions that enhance operational efficiency and elevate user experience.

Benefits: At Tech2i, we value our employees and offer a comprehensive benefits package, including:

· Medical, dental, and vision insurance

· 401(k) plan with employer match

· Training and Development Opportunities

Compensation may vary based on factors such as geographical location, relevant experience, skills, education, and other business considerations.

Equal Employment Opportunity Statement

Company.is an equal opportunity employer and does not discriminate based on race, color, religion, sex, national origin, age, disability, or any other legally protected status.

Job Type: Full-time

Pay: $140,000.00 per year

Benefits:

• 401(k)
• 401(k) matching
• Dental insurance
• Health insurance
• Health savings account
• Paid time off
• Professional development assistance
• Tuition reimbursement
• Vision insurance

Education:

• Bachelor's (Required)

Work Location: Remote