Cyber Security Engineer

CACI is a defense and government services company supporting mission-critical national security customers. The Cyber Security Engineer will support the USTRANSCOM customer by managing RMF and ATO activities, implementing security controls, conducting assessments and vulnerability scanning, and improving secure development processes across DoD environments.

Responsibilities:

• Manage the full RMF accreditation lifecycle and maintain continuous compliance for DoD computing environments
• Create, manage, and maintain RMF artifacts throughout the ATO lifecycle
• Generate and review System Security Plans (SSPs), network diagrams, security architecture documentation, and compliance reports
• Develop and track POA&Ms to support remediation efforts
• Assist the ISSM with continuous monitoring activities
• Perform hands-on security assessments of enclave and network infrastructure devices, primarily within Windows environments
• Design, implement, and validate security controls in accordance with NIST 800-53, DISA STIGs, DFARS, and CMMC frameworks
• Conduct software vulnerability scanning and triage findings across application portfolios
• Interpret and apply DISA STIG requirements using SCC Tool, eMASS, and ACAS
• Work with development, operations, and cybersecurity teams to embed security throughout the SDLC
• Identify and recommend process improvements to strengthen security and enhance productivity
• Provide best-practice guidance for secure system and software development

Requirements:

• • Active Secret security clearance (or ability to obtain)
• • Bachelor's degree in Computer Science, Cybersecurity, Information Systems, or related field (or 4+ years of equivalent experience)
• • 1–3 years of hands-on experience with RMF processes and the ATO lifecycle
• • Experience with:
• • Software/application vulnerability scanning
• • DISA STIG implementation
• • Tools such as eMASS, ACAS, SCC Tool
• • Familiarity with FedRAMP, DISA APL, or DevSecOps concepts
• • Strong technical writing skills for security documentation
• • Ability to work independently and collaboratively
• • Required at hire: Security+ CE, CCNA Security, CySA+, GICSP, GSEC, or SSCP
• • Required within 6 months: SecurityX (IASAE transition preparation)
• • Highly desired: CASP+, CISSP
• • Experience with Fortify or other SAST tools
• • Familiarity with CMMC or NIST 800-171 frameworks
• • Knowledge of SSDLC and Security Engineering principles
• • Understanding of DevSecOps, Agile methodologies, and Zero Trust Architecture
• • Previous experience supporting federal government or DoD customers
• • Ability to apply innovative methods and contribute to new security solutions