Senior Cybersecurity Integration Engineer

POSITION OVERVIEW

The Senior Cybersecurity Integration Engineer secures and integrates the Customer's enterprise API gateway, drives it through the Risk Management Framework to a signed Authority to Operate (ATO), and keeps it authorized. The role pairs hands-on security engineering at the API boundary with ownership of the System Security Plan and the continuous monitoring that sustains it. Requires an active Moderate Background Investigation (MBI) at start.

RESPONSIBILITIES

• Design and enforce API security policy — authentication, authorization, token validation, rate limiting, payload validation, threat protection


• Manage TLS, mutual TLS, and certificate and key lifecycle across all environments and trust relationships


• Onboard applications, vendors, and SaaS services, coordinating firewall, proxy, DNS, and load balancer changes with owning teams


• Integrate the gateway with enterprise identity and federation services


• Harden gateway and hosts to STIG/SCAP and feed security telemetry to the enterprise SIEM


• Promote configuration through the Customer's environments under Government change control


• Author and maintain the SSP and control narratives against NIST 800-53 Rev 5, covering boundary, inventory, inheritance, and tailoring


• Run the RMF package to ATO: evidence, assessor walkthroughs, finding resolution


• Sustain ConMon: recurring scans, false positive validation, remediation and retest, POA&M closure, deviation requests, monthly reporting


• Perform security impact analysis on changes and troubleshoot across gateway, network, identity, and application layers

REQUIRED QUALIFICATIONS

• Active MBI, current and transferable as of your start date


• U.S. citizenship, as required for Customer contractor staff


• Eight years of hands-on cybersecurity or integration engineering on enterprise API gateway, IAM, or boundary security platforms in production, including three years in a Federal FISMA environment


• Production ownership of an enterprise API gateway or comparable platform: policy authoring, upgrades, certificate lifecycle, environment promotion, and production support


• Depth in API and web security protocols: OAuth 2.0, OpenID Connect, JWT validation, SAML 2.0 federation, mutual TLS, PKI, and the OWASP API Security Top 10


• Experience integrating services across network and security boundaries, coordinating changes with separate firewall, proxy, and identity teams


• Authorship of a System Security Plan for a Federal system, writing control narratives from actual configuration and documenting inherited, hybrid, and tailored controls


• Experience carrying a system or major component through RMF to a signed ATO, then sustaining it under continuous monitoring


• Command of FISMA and NIST 800-37, 800-53 Rev 5, 800-53A, and 800-137


• End-to-end vulnerability management: scanning, validating false positives, remediating, retesting, and documenting closure


• Linux administration on RHEL or CentOS, shell scripting, and SIEM log integration such as Splunk


• Technical writing strong enough that control narratives hold up under assessor review


• Bachelor's degree in Engineering, Computer Science, Cybersecurity, or Information Systems, or equivalent hands-on experience

PREFERRED QUALIFICATIONS

• An active professional security certification such as CISSP, CISA, CISM, CAP or CGRC, GIAC, or Security+


• Time as an ISSO or ISSM, or directly supporting one, on a FISMA-reportable system


• Hands-on authoring inside a GRC or RMF tool of record such as eMASS, Xacta, or CSAM


• An active vendor certification on the program's gateway platform, or willingness to earn it within 90 days; training provided


• Prior support to a Federal financial or tax administration program


• Experience with configuration-as-code, separated control and data planes, and API-driven gateway administration


• Depth in a federation platform such as Ping Federate, Ping Access, or CA SiteMinder