Security Engineer

Bixal

. Serve as security lead for a FIPS 199 Moderate federal platform supporting governmentwide regulatory planning and review .

Posted 10/15/2026full-timeRemote • United StatesMid-LevelSenior💰 $130,000 - $140,000 per yearWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates expertise in information security practices, including vulnerability management, compliance with NIST standards, and secure architecture design. Proficient in hardening systems, conducting risk assessments, and maintaining security documentation for federal platforms.

Highest-signal resume keywords

NIST Risk Management FrameworkVulnerability Scanning ToolsA&A DocumentationSecurity ComplianceZero Trust Architecture

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

Information SecuritySystem HardeningVulnerability ManagementIncident ResponseThreat ModelingApplication SecurityCI/CD Security TestingPublic Key InfrastructureNetwork SecurityDatabase Security

Soft Skills

Clear CommunicationStakeholder Engagement

Tools & Technologies

TenableNessusQualysSnykOWASP ZAPRed Hat Enterprise LinuxOracleApache/Tomcat

Certifications & Qualifications

CISSPCISMCompTIA Security+

Industry Keywords

FIPS 199 ModerateFISMANIST SP 800-53 Rev. 5CIS Level 1GSA Security PoliciesPrivacy Impact AssessmentsContinuous Monitoring

Tech Stack

Tools & technologies

ApacheCloudCyber SecurityJavaLinuxOracle

About the role

Key responsibilities & impact

Serve as security lead for a FIPS 199 Moderate federal platform supporting governmentwide regulatory planning and review
Protect and maintain availability of legacy and modernized platforms
Harden, patch, and maintain compliance for Java, Oracle, and Red Hat environments
Run vulnerability scans and lead remediation and patching across Red Hat Enterprise Linux, Oracle, Apache/Tomcat, and Java application components
Meet contractual remediation timelines and document POA&Ms when timelines cannot be met
Harden systems against GSA security benchmarks and CIS Level 1 guidelines
Track end-of-life software, unsupported libraries, and known vulnerabilities; raise risks with recommended paths forward
Support continuous monitoring, log review, incident response, COOP, and disaster recovery planning and testing
Maintain the A&A package under NIST SP 800-37 and SP 800-53 Rev. 5
Maintain POA&Ms and support government-led security assessments, control reviews, and penetration testing
Support privacy compliance artifacts, including Privacy Threshold Assessments and Privacy Impact Assessments
Perform threat modeling for new features, integrations, and architecture decisions
Embed static and dynamic security testing, such as Snyk and OWASP ZAP, in CI/CD pipelines
Review releases for security impact before production
Advise on secure architecture, federated identity, FIPS 140-validated encryption, Zero Trust principles, and software supply chain security
Prepare security packages for prototype testing and position the new platform for an ATO
Provide guidance on PKI, firewall and network security, internet protocols, and configuration management
Serve as the client's security point of contact and brief technical leads and the Project Manager
Coordinate with client IT teams on infrastructure changes and validate system security
Perform other relevant duties as assigned and qualified/trained to perform

Requirements

What you’ll need

Bachelor's degree in Cybersecurity, Computer Science, Information Systems, or a related field
At least 5 years of hands-on information security experience, including securing federal information systems under FISMA
Hands-on experience with the NIST Risk Management Framework, including implementing and assessing NIST SP 800-53 Rev. 5 controls at the Moderate baseline
Experience writing and maintaining A&A documentation, including System Security Plans, contingency plans, incident response plans, and POA&Ms, and supporting a system through ATO
Experience running vulnerability scanning tools such as Tenable/Nessus or Qualys
Experience hardening Linux, preferably Red Hat Enterprise Linux, servers and relational databases, preferably Oracle, against CIS or agency benchmarks
Working knowledge of application security, including the OWASP Top 10 and ASVS, static and dynamic testing tools, and securing CI/CD pipelines
Familiarity with public key infrastructure, TLS certificate management, firewall configuration, and network protocols
Clear, confident communication skills, with the ability to explain risk and trade-offs to technical and non-technical stakeholders, including client leadership
Ability to obtain and maintain a favorable Public Trust determination in support of a federal government contract
Must be legally authorized to work in the US
Bixal does not provide visa sponsorship
Security certifications such as CISSP, CISM, CompTIA Security+, or equivalent are nice to have
Experience with GSA IT security policies, cloud-hosted or containerized platforms, Zero Trust architecture, identity federation, monitoring/logging tools, and legacy-to-modern platform migration are nice to have

Benefits

Comp & perks

Flex hours
401K with matching incentive
Parental Leave
Medical/dental/vision benefits
Flex Spending Account
Company provided short-term disability and life insurance
Commuter benefits
Paid Time Off (PTO)
11 Paid holidays
Reasonable accommodation for disabilities
Professional journey support and inclusive, purpose-driven culture