Information System Security Engineer (ISSE)

Why Castelion, Why Now

Castelion is moving incredibly fast to develop and deliver advanced defense systems at a time when execution matters more than ever. We believe focus, ownership, and excellence are decisive advantages - and we're building a world-class team to turn bold ideas into real capability.

This is a rare opportunity to join at an early stage, where you'll have significant ownership, collaborate with exceptional teammates, and make a direct, measurable impact on our mission and the future of the company - regardless of your function.

Information System Security Engineer

The Information System Security Engineer (ISSE) at Castelion is responsible for translating security requirements into tested controls for classified information systems. In this role, you will harden systems and networks, configure security tools, investigate findings, and work with Information System Security Managers (ISSMs), Information System Security Officers (ISSOs), and IT engineers to support system authorization and continued operation. This position offers the opportunity to build practical security capabilities for disconnected engineering environments that support product development and testing.

Responsibilities

• Harden Windows, Red Hat Enterprise Linux (RHEL), virtualization platforms, and network infrastructure. Apply Defense Information Systems Agency Security Technical Implementation Guides (DISA STIGs), implement approved access and network-segmentation controls, and test changes with IT engineers to preserve required services.
• Configure and maintain security information and event management (SIEM), endpoint protection, and centralized logging. Integrate log sources, tune alerts, verify agent and data-collection health, and support investigation, containment, and recovery when security events occur.
• Assess vulnerabilities and security configurations, prioritize findings with system owners, implement approved fixes, and verify results. Document remaining risks and maintain security tools, patches, and update content through approved offline processes.
• Work with the ISSM and ISSO on Risk Management Framework (RMF) activities to obtain and maintain an Authorization to Operate (ATO). Provide configuration records, scan results, system diagrams, control-implementation evidence, and remediation updates for assessments and Plans of Action and Milestones (POA&Ms).
• Review internally developed software, third-party packages, and container images with developers before introduction into classified systems. Support controlled testing and release, automate repeatable security checks, and maintain operating procedures and change records.

Basic Qualifications

• Hands-on experience supporting classified information systems, including work within approved security boundaries and controlled change processes.
• Experience securing Windows and Linux servers or workstations, including authentication, permissions, auditing, and services; working knowledge of Active Directory and Group Policy.
• Experience hardening networks through segmentation, firewall or access-control rules, secure management interfaces, and restriction of unnecessary ports, protocols, and services.
• Practical experience applying DISA STIGs, assessing configurations through automated and manual checks, documenting findings, and verifying corrective actions.
• Experience configuring or maintaining a SIEM, including log collection, searches, alert tuning, and investigation.
• Experience deploying or administering endpoint protection, including policy configuration, agent health, update management, approved exclusions, and troubleshooting.
• Experience using vulnerability-assessment tools to identify findings, evaluate operational impact, and confirm remediation.
• Experience supporting ISSM/ISSO authorization activities, security-control evidence, assessment preparation, and finding closure under the RMF.
• Ability to troubleshoot security configurations, document work clearly, and explain technical risks and proposed fixes to security and IT teams.
• Experience performing privileged administration on secure or classified systems, including administrative account management, access controls, audit logging, and documented configuration changes.
• Must possess and maintain a current cybersecurity certification accepted for the position’s assigned DoD Cyber Workforce Framework (DCWF) work role and proficiency level, and meet applicable DoD 8140.03 and program qualification requirements.

Preferred Skills and Experience

• Experience maintaining air-gapped systems, including approved media transfers, offline patches, security-content updates, and local software repositories.
• Experience with Splunk or Elastic Security, including Linux rsyslog, Windows event forwarding, or similar log collection methods.
• Experience with Trellix endpoint protection, ePolicy Orchestrator (ePO), or data loss prevention (DLP); Nessus/Tenable; or Security Content Automation Protocol (SCAP) assessment tools and STIG Viewer. Equivalent tool experience is relevant.
• Experience securing VMware vSphere/ESXi or Microsoft Hyper-V, storage and backup services, and Juniper or comparable network infrastructure.
• Experience with PowerShell, Bash, Python, or Ansible to automate configuration checks, evidence collection, or approved remediation.
• Experience with eMASS or comparable authorization-documentation tools, initial system authorization, and applicable NIST security controls, Defense Counterintelligence and Security Agency (DCSA) requirements, or the Joint Special Access Program Implementation Guide (JSIG).
• Experience reviewing software dependencies, container images, and software bills of materials (component inventories), using tools such as Trivy, Anchore, or equivalent. Familiarity with approved on-premises source-control and build/release workflows, such as GitHub Enterprise Server.

Additional Requirements

• Ability to put in extended hours, including evenings and weekends, when required to meet aggressive timelines.
• This role is based in Torrance, CA and requires full-time onsite presence.
• Occasional travel is required.

Physical Demands

• Ability to lift and move equipment weighing at least 40 pounds when supporting equipment installation or maintenance, with or without reasonable accommodation.

Other Duties

Please note this job description is not designed to cover or contain a comprehensive listing of activities, duties or responsibilities that are required of the employee for this job. Duties, responsibilities and activities may change at any time with or without notice.

Benefits and Perks

All full-time employees are granted meaningful long-term equity, sharing in the company’s significant growth trajectory. We offer four (4) weeks of paid time off, ten (10) company-paid holidays, and comprehensive health benefits - including 100% employee-covered medical and strong dependent coverage, along with dental and vision plans. We also provide paid parental leave to support growing families, a $100 monthly fitness stipend to promote health and performance, and onsite EV charging for convenience. In addition, employees enjoy perks like catered meals, company-covered food during high-demand periods, and a fully stocked kitchen to stay fueled throughout the day.

Security Clearance and Access

U.S. citizenship is required. Must possess and maintain an active Top Secret/Sensitive Compartmented Information (TS/SCI) security clearance and meet applicable program-access requirements. This position requires privileged access to classified systems. Required privileged-user training and system-specific authorizations must be completed before performing privileged duties. Castelion offers a generous benefits package. Please refer to the bottom of our Careers page for more details.

Other Duties

Please note this job description is not designed to cover or contain a comprehensive listing of activities, duties or responsibilities that are required of the employee for this job. Duties, responsibilities and activities may change at any time with or without notice.

Additional Eligibility Requirements

This position may require access to classified information or restricted U.S. Government sites, systems, or information, as determined by the Company and/or applicable U.S. Government requirements. If the position is so designated, your employment in the role may be contingent upon your ability to obtain and maintain the required U.S. Government security clearance or other government authorization, and to satisfy any citizenship or other eligibility requirements imposed by applicable law, regulation, executive order, or government contract requirements. You will be notified if and when such requirements apply.

Affirmative Action/EEO Statement

Castelion is an Equal Opportunity Employer. We are committed to providing equal employment opportunities to all applicants and employees without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, age, disability, genetic information, protected veteran status, or any other characteristic protected by applicable federal, state, or local law.

Castelion is committed to providing reasonable accommodations to qualified individuals with disabilities throughout the application and hiring process. If you require a reasonable accommodation to complete an application, participate in the interview process, or otherwise participate in the hiring process, please contact hr@castelion.com. Requests for accommodation will be considered on an individual basis and handled in accordance with applicable law.

Castelion is committed to fostering a workplace where employment decisions are based on qualifications, business needs, and the ability to perform the essential functions of the role, with or without reasonable accommodation.

EAR/ITAR Requirements

This position requires access to export-controlled information, and as such, employment (or hiring of a contractor) is contingent upon the candidate’s ability to access all applicable export-controlled information without additional export licensing being required by the Bureau of Industry and Security and/or the Directorate of Defense Trade Controls.