[Hiring] Senior Baseline Security Engineer @phia, LLC

Role Description

At phia, we hire talented and passionate people who are focused on collaborative, meaningful work, providing technical and operational subject matter expertise and support services to our partners and clients. phia is seeking a mission-driven Senior Baseline Security Engineer to build and maintain the secure configuration baselines that protect a federal financial regulatory agency’s enterprise.

You will step into an established baseline program as one of two contractors working with a federal lead, and own your assigned baselines end to end:

• Create security configuration baselines using CIS Benchmarks and DISA STIGs.
• Modify CIS and STIG benchmarks to meet the client’s organizational requirements, working with each system’s team to negotiate and document deviations and justifications.
• Develop new baselines from vendor documentation for technologies without an existing benchmark.
• Translate low-level baseline settings into high-level FISMA, NIST 800-53, and client-specific security requirements.
• Apply NVD and CVE information to keep baselines current with emerging vulnerabilities.
• Run compliance scans to assess systems against existing baselines, reconcile findings with system owners, and keep baseline and scan results in step.
• Pick up whatever technology needs a baseline next — servers, network devices, cloud and SaaS services, mobile — and build competence quickly from vendor documentation.
• Own assigned baselines with a light touch from the federal lead, and communicate status, deviations, and risk clearly.
• Review and customize general security configuration baselines and support their rollout across the environment.

Qualifications

• 5+ years supporting IT operations.
• You have created baselines using CIS and STIG benchmarks and modified them for an organization.
• You can build a baseline from scratch from vendor documentation.
• You know the NIST 800 series (800-30, -37, -53, -60, -63, -115, -137) and can map settings to controls.
• Comfortable with NVD and CVE data.
• Working familiarity with Linux; you can write a quick bash, PowerShell, or Python check to verify a setting, and you are at home with JSON/YAML.
• You have verified baselines with Tenable (Nessus / Security Center) or a comparable compliance scanner.
• Comfortable owning work with minimal supervision, and clear with system owners when a control needs to bend.

Requirements

• 5+ years of experience providing support to Information Technology (IT) operations.
• Experience creating security baselines using CIS and STIG benchmarks.
• Experience reviewing, developing, or customizing general security configuration baselines.
• Knowledge of NIST 800 Special Publication series guidance for risk management and security control implementation, including 800-30, 800-37, 800-53, 800-60, 800-63, 800-115, or 800-137.
• Knowledge of the National Vulnerability Database (NVD) and Common Vulnerabilities and Exposures (CVE).
• Ability to create security baselines from scratch using vendor documentation.
• Ability to modify CIS and STIG benchmarks to meet organizational requirements.
• Ability to translate low-level security baseline requirements into high-level FISMA, NIST, and client-specific security requirements.

Preferred Skills

• Experience verifying baselines with Tenable (Nessus, Security Center / Tenable.sc) compliance scans, including custom audit files.
• Experience with networking (Cisco, Juniper, or Palo Alto); operating systems (Windows Server, Red Hat, or Linux); cloud services (AWS, Azure, Salesforce, Okta, O365, or ServiceNow); or mobile technologies (iOS or Citrix XenMobile).
• Experience designing, building, and implementing automation tools, including Ansible, Chef, or Puppet.
• Experience with Infrastructure-as-Code tools, including CloudFormation or Terraform.
• Experience with container platforms, including OpenShift.
• Experience with chaos engineering and blue/green deployments.
• Experience with serverless, including AWS Lambda, API Gateway, Step Functions, and SAM.
• Experience with JSON or YAML, and with scripting (bash, PowerShell, or Python) to check or apply settings.
• AWS Certified Solutions Architect, AWS Certified Developer, CCNA, MCSE, or RHCSA certification; CompTIA, ISACA, or ISC2 certifications are also a plus.

Required Education + Clearance

• High school diploma or GED required; Bachelor’s Degree preferred (Experience can be substituted for education).
• Preferred: AWS Certified Solutions Architect, AWS Certified Developer, CCNA, MCSE, or RHCSA; CompTIA, ISACA, or ISC2 certifications also a plus. None are required.
• Public Trust / Suitability; applicants selected will be subject to a security investigation.

GENERAL PROGRAM REQUIREMENTS

• Must be a U.S. Citizen.
• Expected 8.5-hour workday (with a 30-minute break), aligned with the AppSec team’s hours — core hours of approximately 7:30 AM – 4:30 PM US Eastern Time (ET), Monday through Friday; daily team meeting at 8:30 AM ET; schedule is flexible with advance notice.
• Fully remote within the United States; no time on the client site expected.
• Minimal travel.