Security Engineer

The Security Engineer will support the security posture of the CMS Health Insurance Oversight System (HIOS) Platform Team, working within a complex federal production environment. This individual will safeguard cloud infrastructure and sensitive data by designing, implementing, and maintaining robust security solutions, playing a crucial role in identifying and mitigating security risks, automating security processes, and ensuring compliance with industry best practices and regulatory requirements.

The Security Engineer will work as part of a cross-functional Agile team and is expected to:

• Research security issues and assist in creating new security technology solutions.
• Design and develop scripts to automate security control workflow lifecycle.
• Evaluate overall risk by utilizing and enhancing monitoring systems and tools (custom, Splunk, New Relic, firewall, system, application, native CSP, SIEM, and vulnerability scans).
• Participate in the development and implementation of information security operational and strategic procedures, adhering to industry best practices and compliance requirements.
• Execute large client data classification and security assessments.
• Develop and enforce policies for secure API key generation, storage, and rotation.
• Manage remediation plans in support of risk assessment goals.
• Conduct threat modeling exercises to identify potential security risks and vulnerabilities.
• Follow CMS security, accessibility, documentation, configuration management, and software development lifecycle requirements.
• Provide technical guidance and security knowledge sharing to other team members as appropriate.

• Bachelor’s Degree 
• At least four years of relevant experience across compliance, identity, networking, system data, and cloud security, along with experience researching security issues and assisting in creating new security technology solutions, and experience evaluating overall risk using monitoring systems and tools (custom, Splunk, New Relic, firewall, system, application, native CSP, SIEM, and vulnerability scans).

It is the policy of ASM that an individual's race, color, religion, sex, disability, age, sexual orientation or national origin are not and will not be considered in any personnel or management decisions. We affirm our commitment to these fundamental policies.

All recruiting, hiring, training, and promoting for all job classifications is done without regard to race, color, religion, sex, disability, or age. All decisions on employment are made to abide by the principle of equal employment.

Physical Requirements

The physical requirements described in "Knowledge, Skills and Abilities" above are representative of those which must be met by an employee to successfully perform the primary functions of this job. (For example, "light office duties' or "lifting up to 50 pounds" or "some travel" required.) Reasonable accommodations may be made to enable individuals with qualifying disabilities, who are otherwise qualified, to perform the primary functions.

• Monitoring solutions (Splunk, New Relic, etc.)
• Scripting
• Zero Trust Architecture
• AWS/Azure
• Security Remediation
• PKI and API Key Management
• Threat Modeling
• Certificates Management
• Okta
• Kali Linux
• Red Teaming
• Hack-the-Box
• Capture-the-Flag
• Pen Testing
• MITRE ATT&CK Framework
• Strong understanding of cloud security principles and best practices.

Bonus if you have:

• CISSP, CCSP, CompTIA Security+, Cloud Security certificate (any CSP), CISA, CCNA, or other security/network certifications

The preceding job description has been designed to indicate the general nature and level of work performed by employees within this classification. It is not designed to contain or be interpreted as a comprehensive inventory of all duties, responsibilities and qualifications required of employees assigned to this job.