RS21 is excited to announce an opportunity for a dedicated Cyber Security Engineer II to join our team in an embedded role, working directly with our esteemed Federal partner. This position involves delivering cybersecurity expertise specifically in secure software development and database implementation, based out of our Boulder campus with occasional assignments at Federal locations in Boulder and Buckley AFB.

The successful candidate will have robust experience in secure coding practices, notably with the Defense Information Systems Agency (DISA) Application Security and Development Security Technical Implementation Guide (ASD STIG), along with proven proficiency in database security and Python programming. Expertise in the Risk Management Framework (RMF) process, leading to successful Authorization to Operate (ATO) outcomes, is essential. Candidates with a background in Continuous Integration / Continuous Deployment (CI/CD) pipelines and DevSecOps are highly desirable. This role requires a dynamic individual capable of excelling in an agile development environment.

Responsibilities:

• Analyze and fortify software applications using both automated tools and manual approaches.
• Seamlessly integrate security tools and processes into DevSecOps pipelines.
• Enhance and maintain continuous integration tools for software analysis.
• Conduct and analyze compliance scans, producing detailed reports.
• Aid software developers in addressing security issues and in the integration of security measures into system designs.

Clearance Requirement:

• U.S. Citizenship with an active DOD Secret clearance is mandatory. A Top Secret/SCI Clearance is preferred.

Qualifications:

• Holds a Bachelor’s degree in Science, Technology, Engineering, or Mathematics (STEM) with at least 3 years of cyber security engineering experience.
• Well-versed in the Risk Management Framework, NIST standards, and adept at identifying and remedying application vulnerabilities.
• Skilled in programming languages including C++, Python, JavaScript/TypeScript, or Rust.
• Proficient in discovering vulnerabilities using methods like fuzzing.
• Must possess the required Security Certification in accordance with DoD 8570.01 IAT-II for a Linux environment (e.g., Security+ CE, Linux OS Certification).

Nice to Have:

• Advanced knowledge of secure coding practices, with experience in DevSecOps pipelines.
• Capable in application debugging, runtime instrumentation, and using reverse engineering tools.
• Familiar with threat modeling, particularly with the MITRE ATT&CK framework.
• Exceptional collaborative skills and the capability to manage multiple tasks efficiently.

#CJ