Full Job Description
~Must have experience with DOD or agency (Army, Navy, Air Force)
Our direct client is a successful and well-known Marketing and Advertising firm, which is in a significant growth phase and is adding a longer-term Contract or Contract to Hire professionals to their team. The role is a remote-based role located in the Central Time Zone.
Due to the nature of the role and client, we can only consider United States Citizens or Green Card holders residing currently in the United States.
We are looking for a talented Security Engineer to join our DevOps team with a specialty working on DoD systems, implementing, and assessing security controls as needed per DISA and NIST standards. This is a high-impact role, and you'll plan for, contribute to, and collaborate with the several teams making up Security Engineering. We'll work together to continually evaluate your impact and adjust areas of focus as necessary.
You will have support from a global practice where you can learn and develop. We check our egos at the door. You'll make sure our customers benefit from services built to the highest security standards in the industry.
Evaluate, design, and implement security process and technical controls at scale that secure production systems, generate telemetry (logs, alerts) to enhance Rapp's ability to detect, analyze and prevent malicious activity.
Develop tooling to integrate data to improve, enrich and correlate data sources and increase our security monitoring capabilities.
Proactively looks for ways to improve the overall security across the entire ecosystem.
Participate in Risk Management and Security audit process as and when required.
To manage and maintain security in the software development life cycle.
Coordinate with global teams to define and apply consistent processes and controls.
5+ years experience in Security DevOps aka DevSecOps
Deep understanding of at least one major public cloud infrastructures such as Amazon Web Services (AWS)
Experience setting security controls within AWS
NIST 800 familiarity
Bachelor's degree or equivalent experience.
Deep knowledge of enterprise and cloud networks and security controls and detection techniques and technologies.
Expertise building and implementing security controls across clients, including US Govt.
Understanding of cybersecurity, military system specifications, and DoD Information Assurance policies and programs.
Understanding of DISA and NIST compliance standards and experience taking a system through ATO.
In-depth understanding and experience in implementing cybersecurity and IA boundary defense techniques and vulnerability scanning mechanisms.
Awareness of DISA STIG compliance requirements and experience working with the teams to implement these requirements.
Familiarity using SAST, DAST, and web application vulnerability tools
The ability to balance speed and risk using compliance-as-code (CaC) tools to continuously detect and remediate compliance violations.
To optimize and secure DevOps toolchains by assessing them against Rapp's compliance requirements.
Certified in one or more of the following: A+ CE, CCNA-Security, CND, Network+ CE, Security+ CE, SSCP, CySA+, GICSP, GSEC
Understanding of VPCs, public/private subnets, security groups, Roles and Access management, IAM authentication/authorization, encryption at rest/transit, Key management, Secrets Management
Experience in building and maintaining security in tools like Ansible, Chef, and Terraform
History of making smart trade-offs to deliver quality, secure software on time, and of learning from those trade-offs that didn't work out so well
Additional preferred skills:
Experience within AWS GovCloud
Active Secret Security Clearance
Active CAC clearance
CISSP (or Associate) or a CISA
Refer a friend: Referral fee program