Security Compliance Engineer

NexTech Solutions LLC is seeking an experienced Security Compliance Engineer to support its remote, regulated-environment security and compliance operations. The role owns the technical execution of compliance programs by hardening Linux systems, automating STIG and vulnerability-management workflows, supporting FedRAMP and CMMC authorization activities, and maintaining audit-ready evidence across infrastructure and cloud environments.

Responsibilities:

• Apply and maintain DISA STIGs across various Linux distributions (RHEL, Ubuntu, SUSE, etc) using OpenSCAP, Ansible STIG roles and/or manual remediation
• Develop and maintain automated hardening pipelines that produce STIG-compliant OS images via bootc+bib, KIWI/EIB and/or Packer for bare-metal, VM, and cloud deployment targets
• Configure and tune host-based security controls: SELinux (enforcing/targeted/MLS), auditd rules, fapolicyd application whitelisting, firewalld, and PAM
• Implement and validate CIS Benchmark controls as a complement to STIG baselines
• Maintain STIG checklists (CKL/CKLB) and produce POA&M artifacts for findings requiring waivers or scheduled remediation
• Operate and maintain authenticated scanning infrastructure using Tenable Nessus / Security Center or equivalent; schedule, tune, and triage scan results at scale
• Perform continuous CVE triage using NVD, CVSS v3/v4, and EPSS scores to drive prioritized remediation workflows with engineering teams
• Track open vulnerabilities through full lifecycle: discovery, ticket creation, remediation verification, and closure evidence
• Develop metrics and dashboards for vulnerability posture reporting to technical and executive audiences
• Coordinate patch cadence with platform teams; validate patched images against scan baselines before promotion to production
• Support FedRAMP authorization activities (Low, Moderate, or High baselines) including SSP development, control implementation statements, and evidence collection
• Operate and maintain ConMon programs: monthly vulnerability scanning, POA&M updates, significant change requests (SCRs), and annual assessments
• Collaborate with Third Party Assessment Organizations (3PAOs) during assessments; prepare technical staff and produce assessment-ready evidence packages
• Map NIST SP 800-53 Rev 5 controls to technical implementation across infrastructure, applications, and organizational processes
• Maintain the SSP, CIS, SAR, and SAP documentation sets through authorization lifecycle
• Implement and assess CMMC Level 1–3 practices against NIST SP 800-171 and NIST SP 800-172 requirements
• Maintain the System Security Plan (SSP) and associated artifacts (FIPS boundaries, network diagrams, data flow documentation) for CUI-handling environments
• Support DIBCAC assessments and internal readiness reviews; manage corrective action tracking through resolution
• Define and enforce CUI handling procedures, labeling, and access control policies across systems and workflows
• Implement DoD RMF steps (Categorize ? Select ? Implement ? Assess ? Authorize ? Monitor) for new and existing systems
• Generate and maintain Software Bill of Materials (SBOM) artifacts in CycloneDX and SPDX formats for all platform components
• Integrate SBOM generation (Syft) and vulnerability correlation (Grype, Dependency-Track) into CI/CD pipelines
• Enforce software supply-chain controls: artifact signing with cosign / Sigstore, digest pinning, and provenance attestation
• Evaluate third-party components against supply-chain risk criteria prior to onboarding
• Manage PKI infrastructure for internal certificate issuance, renewal, and revocation; integrate with CAC/PIV authentication for privileged accessEnforce FIPS 140-2/3 validated cryptographic module usage across system components, TLS configurations, and disk encryption
• Configure and maintain SSSD, LDAP/AD integration, and PAM stacks for centralized identity and MFA enforcement
• Audit and harden SSH configurations, sudo policies, and privileged access management (PAM/PIM) controls
• Maintain centralized logging pipelines (Splunk, Elastic/OpenSearch, or Wazuh) ingesting auditd, syslog, and application events
• Develop correlation rules and alerts for STIG-required audit events, authentication anomalies, and integrity violations
• Support incident response activities including evidence preservation, log analysis, and post-incident documentation
• Conduct file integrity monitoring (AIDE or equivalent) and respond to integrity alerts within defined SLAs

Requirements:

• • Fluency in English (written and spoken)
• • Must meet eligibility requirements to obtain US Security clearance
• • 5+ years in an information security, system hardening, or security compliance engineering role
• • Hands-on DISA STIG experience across RHEL/CentOS and at least one other OS (Ubuntu, Windows Server)
• • Demonstrated experience operating OpenSCAP, SCAP Workbench, or STIG Viewer for assessment and remediation
• • Proficiency with Ansible for automated configuration management and compliance remediation at scale
• • Direct involvement in at least one FedRAMP authorization or continuous monitoring program
• • Working knowledge of NIST SP 800-53 Rev 5 control families and their technical implementation patterns
• • Experience with authenticated vulnerability scanning using Nessus or equivalent; CVE triage and prioritization
• • Strong Linux systems administration skills: SELinux, auditd, PAM, systemd, firewalld, package management on RPM and DEB systems
• • Ability to read and interpret compliance requirements and translate them into concrete, testable technical controls
• A baseline level of fluency across the technologies listed below is expected. Candidates are not required to be fully proficient in every technology on day one but should be able to quickly build proficiency as needed based on task requirements
• • Compliance Frameworks: FedRAMP (Low/Moderate/High), CMMC L1–L3, NIST SP 800-53, NIST SP 800-171, DISA STIGs, DoD RMF
• • STIG & Hardening: DISA STIG Viewer, OpenSCAP / oscap, Ansible STIG roles, CIS Benchmarks, fapolicyd, auditd
• • Vulnerability Mgmt: Tenable Nessus / Security Center, Rapid7, OpenVAS, CVE / NVD, CVSS scoring, EPSS
• • OS Platforms: RHEL 8/9, AlmaLinux, Rocky Linux, Ubuntu 22.04/24.04 LTS
• • Image & Config Mgmt: Packer (QEMU, Hyper-V, vSphere), Ansible, Chef InSpec, Puppet, cloud-init, bootc
• • PKI & Identity: RHCS / Dogtag, Active Directory / LDAP, SSSD, CAC / PIV, FIPS 140-2/3, SELinux
• • SBOM & Supply Chain: Syft, Grype, Dependency-Track, cosign, Sigstore, trivy, CycloneDX / SPDX
• • SIEM & Monitoring: Splunk, Elastic / OpenSearch, Wazuh, AIDE, auditd, syslog-ng, Graylog
• • Automation & IaC: Ansible / AWX, Terraform / OpenTofu, GitLab CI, Bash, Python
• • Cloud & Virtualization: AWS GovCloud, Azure Government, GCP Assured Workloads, VMware vSphere, Hyper-V, QEMU/KVM
• • Prolonged periods of sitting at a desk and working on a computer
• • Frequent use of hands and fingers for typing, writing, and handling documents
• • Clear vision and hearing required for meetings, presentations, and communication
• • Ability to travel up to 20% of the time, which may include extended periods of standing, walking, or navigating airports and government facilities
• • Some customer site visits, no expectation of OCONUS
• • This is a remote position
• • Candidates must reside in the US and US Citizenship is required
• • Active DoD Secret or TS/SCI security clearance preferred
• • CMMC Registered Practitioner (RP), Certified Professional (CP), or equivalent CMMC assessment experience
• • One or more of: CompTIA Security+, CISSP, CISM, GIAC GCED, RHCSA/RHCE, or equivalent certification
• • Experience with cloud-native FedRAMP environments in AWS GovCloud, Azure Government, or GCP Assured Workloads
• • Familiarity with container and Kubernetes security hardening: Pod Security Standards, Kyverno / OPA policies, CIS Kubernetes Benchmark
• • Experience with FIPS boundary documentation, cryptographic module validation (CMVP), and FIPS-mode OS configuration
• • Prior 3PAO, ISSO, ISSM, or Authorizing Official (AO) support experience
• • Scripting proficiency in Python or Go for tooling automation beyond Bash/Ansible