Senior Information Security Engineer

Leidos is an industry and technology leader serving government and commercial customers with smarter, more efficient digital and mission innovations. They are seeking a Senior Information Security Engineer to support the Department of Veterans Affairs’ Office of Information & Technology, focusing on advancing cybersecurity operations for Federal cloud environments.

Responsibilities:

• Support all six steps of the NIST RMF lifecycle and develop/maintain required RMF documentation and security diagrams
• Prepare, submit, and track ATO/ATC packages and reauthorization efforts across HAPS capabilities, services, and hosted applications; ensure no lapse in ATO status
• Conduct and coordinate recurring vulnerability scans across infrastructure, containers, applications, and code repositories; track findings through POA&M closure within Government-defined timelines
• Draft and maintain Incident Response Plans and Disaster Recovery Plans, including RACI charts, and host/support annual IRP/DRP tabletop exercises
• Support all security audits and assessments (e.g., IG, SAVD, CCTF, OIS, ISRM, GRC, and independent assessors such as MITRE or Palo Alto), including documentation, findings review, and closeout meetings
• Maintain required security documentation (SIA, PIA, PTA, ISCP, SAP, SAR, Configuration Management Plan) and diagrams (ICD, HLD, security assessment boundary diagrams)
• Conduct periodic user access/account audits, enforce least-privilege and role-based access controls, and rotate service account credentials per VA policy and NIST guidelines
• Prepare and submit the Monthly RMF, Security, and ATO Status Report, clearly flagging deficiencies, emerging risks, and significant changes on the first page
• Support Technical Reference Model (TRM) software authorization submissions and Business Partner Extranet (BPE) connection request management as needed

Requirements:

• Bachelors degree in Cybersecurity, Computer Science, Information Technology, or a related field
• Minimum of 12 years of experience in information security, cybersecurity engineering, or RMF compliance within Federal or DoD environments; candidates without a degree must have at least 18 years of relevant experience
• Experience managing ATO/ATC activities
• Experience managing Security assessments
• Experience managing Continuous monitoring
• Experience managing SNOWCAM
• Experience managing Nessus scanning
• Experience managing Vulnerability remediation
• Experience managing Audit coordination
• Experience managing Incident response planning
• Experience managing Enterprise security governance
• Experience preparing and maintaining Authority to Operate (ATO)/Authority to Connect (ATC) packages and supporting artifacts (e.g., SSP, SAP, SAR, POA&M, ISCP)
• Experience conducting or coordinating vulnerability scanning, patch/remediation tracking, and continuous monitoring reporting for cloud-hosted platforms
• Experience developing and maintaining Incident Response Plans (IRP) and Disaster Recovery Plans (DRP), including facilitating tabletop exercises
• Working knowledge of applicable federal security and privacy requirements (FISMA, NIST 800-53, HIPAA, Privacy Act, FIPS)
• The ability to obtain and maintain a Public Trust security clearance
• The ability to travel, as needed, to customer sites
• Must have a US Citizenship
• Experience supporting VA-specific RMF/ATO systems and processes (e.g., SNOWCAM, ICAMP, Technical Reference Model (TRM), CONMON)
• Experience coordinating directly with Authorizing Officials (AO), Information System Security Officers (ISSO), and Information System Owners (ISO) on authorization and security posture activities
• Experience conducting user access/account audits and enforcing role-based access control, Zero Trust Architecture, and least-privilege principles
• Experience supporting penetration testing, red team activities, or independent third-party security assessments
• Experience drafting Plan of Action and Milestones (POA&M) mitigation plans aligned to NIST control families and Control Correlation Identifiers (CCI)
• Experience managing external connection request processes (e.g., Business Partner Extranet) and software authorization submissions
• Eligibility for or possession of a security clearance or public trust position, as required