RIVA Solutions

Government IT consulting and cybersecurity services

Mid-Level Security Engineer

Security Engineering & ArchitectureConfirmed live in the last 24 hours

Full-timeAlexandria, VA, USA$135k - $150kIn-person

About the Job

Requirements

A Bachelor's degree and five years of relevant experience, or a Master's degree and three years of relevant experience, in cybersecurity, information assurance, or a related technical field.
An active CISSP certification is required.
Hands-on experience with GitLab CI/CD pipeline security, including SAST/DAST tooling, container image scanning, and infrastructure-as-code security analysis within a DevSecOps software factory.
Working knowledge of Kubernetes security, including admission controllers, runtime scanning, container vulnerability management, and role-based access control in a multi-cloud environment.
Familiarity with SIEM platforms such as XSIAM or QRadar, or equivalent, and ITSM remediation workflows such as ServiceNow, or equivalent, for security finding triage and POA&M tracking.
Knowledge of NIST SP 800-53 security controls, FedRAMP requirements, and federal ATO processes, with the ability to produce structured security evidence for compliance reporting.
Scripting and automation skills using Python or Bash, Git-based workflows, REST API interaction, GitLab CI YAML pipeline configuration, and parsing and querying JSON-formatted findings for triage and reporting.

Responsibilities

Operate and maintain Wiz Code in the USPTO GitLab CI/CD software factory by configuring container image scanning and infrastructure-as-code template analysis gates, triaging findings, and ensuring enforcement changes go through USPTO GitLab review gates before production.
Run Snyk Agent Scan on AI-native artifact types, including Markdown prompt files, cursor rules, GitHub Copilot instruction files, and Model Context Protocol configuration files, within the GitLab pipeline; triage scan results and route confirmed findings to the ServiceNow SMP remediation queue with appropriate severity tags.
Maintain and tune Kubernetes security posture across the USPTO container estate by configuring admission controls, monitoring runtime alerts from Wiz Defend, and escalating container-level findings through the remediation workflow.
Correlate DSPM findings with Axonius asset context and Tenable vulnerability data to prioritize remediation backlogs, and maintain and update the risk-scored source inventory in coordination with the DSPM subject matter expert.
Monitor XSIAM and QRadar SIEM telemetry for security events correlated to DSPM findings, triage alerts, update the POA&M, and contribute structured findings to operational, compliance, and executive reporting.
Support Netskope FedRAMP High CASB administration by assisting with browser-path and SaaS-path data loss prevention policy tuning, investigating policy violations, and documenting exception requests through the exception register process.
Perform security audits, risk analysis, application-level vulnerability testing, and security code reviews for the DSPM implementation and integrated AI platforms, including AWS Bedrock and UGAP API service broker endpoints.
Support Authority to Operate documentation, system security plan maintenance, and FISMA reporting, and contribute security evidence to compliance reporting and the dashboard package.
Participate in Agile sprint ceremonies and contribute to security user stories, acceptance criteria, and definition-of-done security checks within the two-week sprint cadence.

Desired Qualifications

Prior experience with Wiz Code, Defend, or DSPM; Snyk Agent Scan; or Netskope CASB in a federal or FedRAMP-authorized environment.
Familiarity with Axonius asset management and Tenable vulnerability management as inputs to security risk scoring.
Experience securing AI serving infrastructure, including AWS Bedrock, SageMaker, or API gateway brokering patterns, and understanding of AI artifact security risks such as prompt injection and MCP configuration exposure.
Additional certifications such as CKS (Certified Kubernetes Security Specialist), AWS Security Specialty, CEH, OSCP, or CompTIA Security+.
Prior federal civilian agency experience on a cybersecurity, data governance, or DevSecOps program.
Familiarity with policy-as-code and Kubernetes admission control tooling such as OPA/Gatekeeper or Kyverno, secrets detection tooling, and SBOM/dependency analysis in CI pipelines.

RESULTS. INNOVATION. VALUES. ACCOUNTABILITY.

That’s RIVA.

We’re a mission-driven IT services company and systems integrator supporting digital transformation and modernization for federal government agencies. Since 2009, we’ve partnered with our customers to solve complex challenges through smart, practical innovation to deliver real outcomes where they matter most. Our teams are made up of industry-leading experts who are passionate about doing great work and making a difference. We don’t just develop solutions, we support efforts that strengthen communities and serve the public good.

RIVA’s culture is built on four core values: Results, Innovation, Values, and Accountability. They guide how we work, how we collaborate, and how we measure success. Our employee-first approach is rooted in trust, ownership, and meaningful work. By investing in our people and fostering a flexible, supportive environment, employees have the opportunity to grow their skills, contribute ideas, and make an impact from day one. all while supporting missions that matter.

POSITION OVERVIEW

This role performs hands-on security analysis, vulnerability testing, and DevSecOps integration work within the RIVA GitLab CI/CD software factory and the USPTO's approximately 4,000-container Kubernetes environment. The Security Engineer operates under the guidance of senior security personnel and is a primary contributor to the AI Artifact Security objective (SOO 4.1.3), embedding automated security gates into the pipeline and ensuring findings flow through the ServiceNow SMP remediation workflow.

CORE RESPONSIBILITIES

Operate and maintain Wiz Code within the USPTO GitLab CI/CD software factory: configure container image scanning and infrastructure-as-code (IaC) template analysis gates, triage findings, and ensure no code reaches production on a contractor-only path—every enforcement change ships through USPTO's GitLab review gates
Run Snyk Agent Scan on AI-native artifact types—Markdown prompt files, cursor rules, GitHub Copilot instruction files, and Model Context Protocol (MCP) configuration files—within the GitLab pipeline; triage scan results and route confirmed findings into the ServiceNow SMP remediation queue with appropriate severity tags
Maintain and tune Kubernetes security posture across the USPTO container estate: configure admission controls, monitor runtime alerts from Wiz Defend, and escalate container-level findings through the defined remediation workflow
Correlate DSPM findings with Axonius asset context and Tenable vulnerability data to prioritize remediation backlogs; maintain and update the risk-scored source inventory in coordination with the DSPM SME
Monitor XSIAM and QRadar SIEM telemetry for security events correlated to DSPM findings; triage alerts, update the POA&M, and contribute structured findings to the three-tier evidence chain (operational, compliance, executive reporting)
Support Netskope FedRAMP High CASB administration: assist with browser-path and SaaS-path DLP policy tuning, investigate policy violations, and document exception requests through the exception register process
Perform security audits, risk analysis, application-level vulnerability testing, and security code reviews for the DSPM implementation and integrated AI platforms including AWS Bedrock and UGAP API service broker endpoints
Support ATO (Authority to Operate) documentation, system security plan (SSP) maintenance, and FISMA reporting; contribute security evidence to the compliance reporting and dashboard package
Participate in Agile sprint ceremonies; contribute to security user stories, acceptance criteria, and definition-of-done security checks within the two-week sprint cadence

MINIMUM QUALIFICATIONS

Bachelor's degree and 5 years of relevant experience, or Master's degree and 3 years of relevant experience in cybersecurity, information assurance, or a related technical field
Active CISSP certification (required per USPTO BOSS LCAT qualification)
Hands-on experience with GitLab CI/CD pipeline security, including SAST/DAST tooling, container image scanning, and IaC security analysis within a DevSecOps software factory
Working knowledge of Kubernetes security: admission controllers, runtime scanning, container vulnerability management, and RBAC in a multi-cloud environment
Familiarity with SIEM platforms (XSIAM, QRadar, or equivalent) and ITSM remediation workflows (ServiceNow or equivalent) for security finding triage and POA&M tracking
Knowledge of NIST SP 800-53 security controls, FedRAMP requirements, and federal ATO processes; ability to produce structured security evidence for compliance reporting
Scripting and automation skills for security engineering: Python or Bash, Git-based workflows, REST API interaction, GitLab CI YAML pipeline configuration, and the ability to parse and query JSON-formatted findings for triage and reporting

PREFERRED QUALIFICATIONS

Prior experience with Wiz (Code, Defend, or DSPM), Snyk Agent Scan, or Netskope CASB in a federal or FedRAMP-authorized environment
Familiarity with Axonius asset management and Tenable vulnerability management as inputs to security risk scoring
Experience securing AI serving infrastructure—AWS Bedrock, SageMaker, or API gateway brokering patterns—and understanding of AI artifact security risks (prompt injection, MCP configuration exposure)
Additional certifications such as CKS (Certified Kubernetes Security Specialist), AWS Security Specialty, CEH, OSCP, or CompTIA Security+
Prior federal civilian agency experience on a cybersecurity, data governance, or DevSecOps program
Familiarity with policy-as-code and Kubernetes admission control tooling (OPA/Gatekeeper or Kyverno), secrets detection tooling, and SBOM/dependency analysis in CI pipelines

The salary or salary range for this role reflects an estimated range informed by multiple compensation factors. Final offers may vary based on considerations such as relevant experience, education and training, critical skillsets, and overall business needs.

Pay range

$135,000—$150,000 USD

EQUAL EMPLOYMENT OPPORTUNITY & ACCOMMODATION

We believe great teams are built from different backgrounds, perspectives, and lived experiences, and we mean that beyond the buzzwords.

RIVA is an equal opportunity employer. We welcome applicants of every race, color, religion, sex, sexual orientation, gender identity, national origin, age, disability, veteran status, and any other characteristic protected by law.

If you need an accommodation at any point in our process, send an email to [email protected], we'll be happy to help.

VETERAN SUPPORT & ACCESSIBILITY

As a federal contractor, RIVA follows the requirements of the Vietnam Era Veterans' Readjustment Assistance Act (VEVRAA) and Section 503 of the Rehabilitation Act, supporting the employment and advancement of protected veterans and individuals with disabilities. If you're a veteran, we encourage you to self-identify during the application process, it helps us track our hiring commitments and, in some cases, may support priority referral for open roles.

RIVA also invites applicants to voluntarily self-identify as having a disability during the application process, not because it affects your chances of being hired, but because it helps us measure how well we're living up to our commitments and identify where we can do better. Your response is confidential and entirely optional.

Pay range 135000 - 150000 USD

About the Company

RIVA Solutions

Government IT consulting and cybersecurity services

RIVA Solutions provides government-focused services across management consulting, science and engineering, digital services, emerging technologies, infrastructure and cloud, data science, cybersecurity, and DevSecOps for Defense, Homeland Security, Intel, and civilian agencies. It works by pairing managers, technologists, and scientists who collaborate on projects, supported by an Innovation Lab that assesses new technologies and processes to improve efficiency and cut costs. It differentiates itself through its combination of management and technical talent, mission-focused outcomes, and a strong emphasis on training and career development to grow its workforce. Its goal is to solve complex problems with creative, technology-enabled solutions and to transform agencies through enterprise solutions that enable better government outcomes.

Company size: 201-500
Company stage: Not listed
Total funding: Not listed
Headquarters: McLean, VA
Founded: 2009

Recently Posted Jobs

Explore more opportunities at RIVA Solutions

See more jobs