Cybersecurity engineer

This position is listed on behalf of a partner company, which manages all applications and next steps. Our partner is looking for a Cybersecurity Engineer based in the United States.

We are seeking an experienced Cybersecurity Engineer to lead the security and compliance of a complex, unclassified IT environment supporting sensitive defense and national security operations. In this hands-on individual contributor role, you will strengthen security controls, assess technical configurations, and maintain compliance with NIST SP 800-171 and CMMC Level 2 requirements. You will take ownership of compliance documentation, technical self-assessments, vulnerability remediation, and audit readiness while helping build and improve an evolving cybersecurity program. Working closely with enterprise IT, cybersecurity operations, and organizational leadership, you will translate regulatory requirements into practical security measures that protect Controlled Unclassified Information (CUI). This opportunity is ideal for a technically strong security professional who enjoys taking initiative, improving processes, and balancing rigorous compliance standards with real-world infrastructure needs. You will play a critical role in maintaining security, accountability, and trust across cloud, hybrid, and enterprise systems.

Accountabilities

• Cybersecurity Compliance and Governance: Own the security and compliance posture of the unclassified environment, maintaining the System Security Plan (SSP) in alignment with NIST SP 800-171 and CMMC Level 2 requirements.
• Risk Management and Remediation: Track security findings, vulnerabilities, and compliance gaps; maintain Plans of Action and Milestones (POA&Ms); and coordinate timely remediation with relevant technical teams.
• Security Assessment Reporting: Generate, maintain, and validate Supplier Performance Risk System (SPRS) scores, identify control deficiencies, and prepare the environment for independent third-party assessments.
• Change Management: Follow established change management procedures and Change Control Board (CCB) requirements, ensuring infrastructure modifications are properly reviewed, validated, and tested before production deployment.
• Internal Assessments and Audit Readiness: Independently plan and conduct comprehensive technical self-assessments to validate control implementation and effectiveness across the unclassified network.
• External Assessment Coordination: Prepare for Certified Third-Party Assessment Organization (C3PAO) assessments by organizing evidence, interviewing technical staff, documenting controls, and providing accurate technical responses to auditors.
• Cloud and Hybrid Infrastructure Security: Secure and monitor Google Workspace and Microsoft environments, including Active Directory and Group Policy, ensuring appropriate separation of duties, access management, and secure remote access.
• CUI Protection Controls: Ensure data loss prevention (DLP), access controls, endpoint security, and mobile device management (MDM) configurations meet applicable requirements for protecting Controlled Unclassified Information.
• Configuration Monitoring: Monitor infrastructure and security settings for configuration drift against established CUI security baselines and coordinate corrective actions when gaps arise.
• Vendor and Software Security Assurance: Serve as the primary cybersecurity contact for evaluating new enterprise software and third-party vendors, assessing compliance requirements before tools are introduced into the environment.
• Cross-Functional Collaboration: Partner with Enterprise IT and IT/Cyber Operations to implement security controls, resolve findings, and maintain compliance across the unclassified environment.
• Program Reporting and Continuous Improvement: Provide leadership with accurate information on security posture, compliance risks, and remediation progress while improving assessment workflows, evidence collection, and compliance processes.

Requirements:

• U.S. citizenship is required, along with authorization to work in the United States, due to requirements associated with access to CUI and ITAR-related data.
• Five to eight years of professional cybersecurity experience, including at least three years specifically focused on NIST SP 800-171 compliance and implementation.
• Demonstrated experience configuring and securing Google Workspace in a regulated environment, including security and compliance controls across Drive, Gmail, and endpoint management.
• Proven ability to independently conduct technical security self-assessments, test control effectiveness, identify deficiencies, and collect defensible evidence for audit purposes.
• In-depth knowledge of NIST SP 800-171, CMMC Level 2 assessment guides, and applicable Defense Federal Acquisition Regulation Supplement (DFARS) requirements, including clauses 252.204-7012, 252.204-7019, and 252.204-7020.
• An active DoD 8570/8140 IAM Level II or Level III certification, such as CISSP, CISM, CASP+, or CAP.
• Strong technical documentation skills and the ability to explain complex security requirements, risks, and remediation plans to non-technical stakeholders and external auditors.
• Experience working across cloud-based and hybrid IT environments, with a practical understanding of access controls, configuration management, endpoint security, and compliance monitoring.
• Strong analytical and organizational skills, with the ability to manage multiple findings, changing priorities, and evolving compliance requirements independently.
• Excellent communication and collaboration skills, particularly when coordinating remediation efforts across IT, cybersecurity, and business teams.
• A CMMC Certified Professional (CCP) or Registered Practitioner (RP) credential is preferred.
• Google Professional Cloud Security Engineer or Professional Google Workspace Administrator certification is an advantage.
• An active Secret or Top Secret security clearance is a plus but is not required for this role.
• Experience as a formal Security Control Assessor (SCA) or Qualified Security Assessor (QSA) is preferred.
• Familiarity with endpoint detection and response (EDR), security information and event management (SIEM), and incident-response tools is beneficial.

Benefits:

• Annual base salary: $145,000–$163,000 USD.
• Performance-based compensation: Additional performance bonus opportunities.
• Equity: Equity compensation as part of the overall rewards package.
• Healthcare coverage: Medical, dental, and vision benefits.
• Retirement savings: 401(k) plan.
• Paid time off: PTO to support personal time and work-life balance.
• Remote flexibility: Remote position with responsibility for securing and monitoring the organization's unclassified environment.
• Technical ownership: Opportunity to lead hands-on compliance implementation, security assessments, and remediation initiatives.
• Professional impact: Help strengthen cybersecurity practices supporting sensitive defense and national security operations.
• Program development: Build and improve compliance processes, assessment practices, and security evidence workflows as the environment evolves.
• Cross-functional collaboration: Work closely with IT, cybersecurity operations, leadership, and external assessors to strengthen organizational security and compliance.

How Jobgether works: We use an AI-powered matching process to ensure your application is reviewed quickly, objectively, and fairly against the role's core requirements. Our system identifies the top-fitting candidates, and this shortlist is then shared directly with the hiring company. The final decision and next steps (interviews, assessments) are managed by their internal team. We appreciate your interest and wish you the best!

Why Apply Through Jobgether? Data Privacy Notice: By submitting your application, you acknowledge that Jobgether will process your personal data to evaluate your candidacy and share relevant information with the hiring employer. This processing is based on legitimate interest and pre-contractual measures under applicable data protection laws (including GDPR). You may exercise your rights (access, rectification, erasure, objection) at any time.