[Hiring] Security Engineer @ASM Research

Role Description

The Security Engineer will support the security posture of the CMS Health Insurance Oversight System (HIOS) Platform Team, working within a complex federal production environment. This individual will safeguard cloud infrastructure and sensitive data by designing, implementing, and maintaining robust security solutions, playing a crucial role in identifying and mitigating security risks, automating security processes, and ensuring compliance with industry best practices and regulatory requirements.

The Security Engineer will work as part of a cross-functional Agile team and is expected to:

• Research security issues and assist in creating new security technology solutions.
• Design and develop scripts to automate security control workflow lifecycle.
• Evaluate overall risk by utilizing and enhancing monitoring systems and tools (custom, Splunk, New Relic, firewall, system, application, native CSP, SIEM, and vulnerability scans).
• Participate in the development and implementation of information security operational and strategic procedures, adhering to industry best practices and compliance requirements.
• Execute large client data classification and security assessments.
• Develop and enforce policies for secure API key generation, storage, and rotation.
• Manage remediation plans in support of risk assessment goals.
• Conduct threat modeling exercises to identify potential security risks and vulnerabilities.
• Follow CMS security, accessibility, documentation, configuration management, and software development lifecycle requirements.
• Provide technical guidance and security knowledge sharing to other team members as appropriate.

Qualifications

• Bachelor’s Degree
• At least four years of relevant experience across compliance, identity, networking, system data, and cloud security.
• Experience researching security issues and assisting in creating new security technology solutions.
• Experience evaluating overall risk using monitoring systems and tools (custom, Splunk, New Relic, firewall, system, application, native CSP, SIEM, and vulnerability scans).

Requirements

• Monitoring solutions (Splunk, New Relic, etc.)
• Scripting
• Zero Trust Architecture
• AWS/Azure
• Security Remediation
• PKI and API Key Management
• Threat Modeling
• Certificates Management
• Okta
• Kali Linux
• Red Teaming
• Hack-the-Box
• Capture-the-Flag
• Pen Testing
• MITRE ATT&CK Framework
• Strong understanding of cloud security principles and best practices.

Benefits

• Compensation ranges for ASM Research positions vary depending on multiple factors; including but not limited to, location, skill set, level of education, certifications, client requirements, contract-specific affordability, government clearance and investigation level, and years of experience.
• The compensation displayed for this role is a general guideline based on these factors and is unique to each role.
• Monetary compensation is one component of ASM's overall compensation and benefits package for employees.