ISSM / Security Automation Engineer

Quantum Sky engineers cybersecurity, networks, software, and quantum technologies for mission-critical environments. The company is seeking an Information System Security Manager (ISSM) / Security Automation Engineer to lead NIST RMF, security authorization, and continuous assurance activities while developing automation for cybersecurity and compliance. The role integrates security into cloud and DevSecOps workflows, manages vulnerabilities and risk, and delivers continuous security visibility.

Responsibilities:

• Lead RMF, Security Authorization & Continuous Assurance — Own NIST RMF implementation, system authorization and ongoing authorization activities, including SSPs, control implementation documentation, risk assessments, continuous monitoring artifacts, and coordination with system owners, assessors, ISSOs, engineers, and Authorizing Officials
• Engineer Security & Compliance Automation — Design, develop, and maintain production-quality automation using Python, PowerShell, Bash, APIs, and cloud-native technologies to automate control validation, evidence collection, compliance reporting, security assessments, and remediation workflows
• Implement Compliance as Code & Continuous Control Monitoring — Translate NIST SP 800-53 controls and organizational requirements into measurable technical requirements, machine-readable policies, automated validation procedures, and continuous control monitoring capabilities
• Embed Security into Cloud & DevSecOps Workflows — Partner with engineering and platform teams to integrate security into cloud architectures, Infrastructure as Code, CI/CD pipelines, containers, Kubernetes, and software delivery processes, including automated testing, policy validation, and security gates
• Integrate Security Platforms, Data & Tooling — Build integrations and reusable services connecting cloud platforms, vulnerability scanners, security tools, GRC platforms, ticketing systems, source-code repositories, and CI/CD systems using APIs and structured data such as JSON and YAML
• Manage Vulnerabilities, Findings & Cybersecurity Risk — Automate vulnerability and configuration finding ingestion, correlation, prioritization, assignment, tracking, and reporting; manage POA&Ms, exceptions, and remediation through closure; and evaluate system architectures and changes for cybersecurity risk
• Deliver Continuous Security Visibility & Improvement — Develop dashboards, metrics, and automated reporting that provide actionable visibility into vulnerabilities, configuration compliance, control status, POA&Ms, and organizational risk while identifying opportunities to replace manual security reviews with automated technical validation

Requirements:

• Bachelor's degree in Cybersecurity, Computer Science, Information Technology, Software Engineering, or a related field, or equivalent professional experience
• Demonstrated experience as an ISSM, ISSO, Security Engineer, Cloud Security Engineer, DevSecOps Engineer, or similar technical cybersecurity professional
• Strong knowledge of NIST SP 800-53, NIST SP 800-37, RMF, security authorization, security control assessment, and continuous monitoring
• Demonstrated hands-on experience developing production-quality automation, scripts, integrations, or software
• Strong programming or scripting experience with Python and experience with one or more additional languages or scripting environments such as PowerShell, Bash, JavaScript, or Go
• Experience working with JSON and YAML
• Experience automating cybersecurity, infrastructure, compliance, or operational processes
• Experience with vulnerability scanning and vulnerability management technologies
• Experience with cloud platforms such as AWS, Azure or GCP
• Ability to understand cloud and enterprise system architectures and evaluate their security implications
• Ability to translate regulatory and cybersecurity requirements into technical engineering requirements
• Experience developing automation against AWS, Azure or GCP API/SDKs
• Experience with Infrastructure as Code technologies such as Terraform
• Experience with configuration management and automation technologies such as Ansible
• Experience with CI/CD platforms such as GitHub Actions, GitLab CI/CD, Jenkins, or Azure DevOps
• Experience with container and orchestration technologies such as Docker and Kubernetes
• Experience integrating vulnerability scanners, SIEM platforms, CSPM/CNAPP solutions, GRC platforms, and ticketing systems
• Experience developing security dashboards and data pipelines
• Experience with automated testing frameworks and software engineering practices
• Experience with serverless architectures and event-driven automation
• Experience transforming NIST controls and security documentation into structured, machine-readable data
• Experience with Compliance as Code and Policy as Code technologies such as Open Policy Agent (OPA)
• Experience implementing automated security evidence collection and continuous control validation
• Experience supporting FISMA, FedRAMP, DoD RMF, CMMC, or other federal cybersecurity programs
• Experience supporting systems through initial authorization and ongoing authorization processes
• Experience working with Security Control Assessors (SCAs), Third Party Assessment Organizations (3PAOs), or government Authorizing Officials
• Experience developing or maintaining SSPs, POA&Ms, Security Assessment Reports, continuous monitoring documentation, and supporting authorization artifacts
• Familiarity with federal security baselines, implementation guidance, and security assessment procedures
• One or more of the following is preferred:
• CISSP, CGRC, CISM, CCSP, Security+
• AWS Solution Architect or Security Specialty
• GCP Cloud Architect or Security Engineer
• Certified Kubernetes Security Specialist (CKS)