Remote Baseline Security Engineer

Required Skills & Experience

-5+ years of experience providing support to Information Technology (IT) operations -Experience creating security baselines using CIS and STIG benchmarks -Experience reviewing, developing, or customizing general security configuration baselines -Knowledge of NIST 800 Special Publication series guidance for risk management and security control implementation, including 800-30,800-37, 800-53, 800-60, 800-63, 800-115, or 800-137 -Knowledge of the National Vulnerability Database (NVD) and Common Vulnerability Enumeration (CVE) -Ability to create security baselines from scratch using vendor documentation -Ability to modify CIS and STIG benchmarks to meet organizational requirements -Ability to translate low-level security baseline requirements into high-level FISMA and NIST requirements and client-specific security -Ability to obtain and maintain a Public Trust or Suitability/Fitness determination based on client requirements -HS diploma or GED

Nice to Have Skills & Experience

-Experience with networking, including Cisco, Juniper, or Palo Alto, operating systems, including Windows Server, Red Hat, or Linux, cloud services, including AWS, Azure, Salesforce, Okta, O365, or ServiceNow, or mobile technologies, including iOS or Xen Mobile -Experience designing, building, and implementing automation tools, including Ansible, Chef, or Puppet -Experience with Infrastructure-as-Code tools, including CloudFormation or Terraform -Experience with container platforms, including OpenShift -Experience with chaos engineering and blue or green deployments -Experience with serverless, including Lambda, API Gateway, Step Functions, and SAM -Experience with application performance analysis and monitoring, including ELK -Experience with JSON or YMAL programming -Bachelor's degree -AWS Certified Solutions Architect, AWS Certified Developer, CCNA, MSCE, RHCSA, EBSA, or ECSS Certification

Job Description

5+ years of IT/security experience who has hands-on CIS or STIG experience and has actually created or customized security baselines. They need to understand NIST 800-53/RMF and be technical enough to understand how Windows, Linux, networking, or cloud systems should be hardened. The biggest thing is that I don't just want someone who has worked in a STIG environment. I want someone who has actually built, modified, or maintained the baselines.

This person is essentially building the security standards that tell the SEC how its technology needs to be configured. Booz needs someone who understands CIS and STIGs well enough to not just follow them, but actually create and customize security baselines for different technologies. They then tie those technical settings back to NIST and FISMA requirements.