Note: The job is a remote job and is open to candidates in USA. OneZero Solutions LLC is an employee-centric cybersecurity company supporting customer missions. The Cyber Security Engineer operates Tenable and Wiz vulnerability and compliance platforms, manages scanning and remediation workflows, and supports DevSecOps security controls across CI/CD and configuration-management pipelines.
Responsibilities
- Operate Tenable andWiz dayto day: scan execution and scheduling, Nessus Agent deployment and health, asset onboarding, grouping and tagging per CA configuration standards, and quality review of results
- Distribute vulnerability and compliance scan results to ISSOs within 5 business days of scan completion; produce remediation tracking reports and metrics; supportiPostapplication groupings
- Participate in the on-call rotation and support platform backups, patching, and troubleshooting under direction of the Cyber Security Engineer III
- Triage vulnerability, KEV, CVE, and STIG scan results; assist ISSOs in prioritizing critical and high findings to Department and BOD timelines
- Ensure applicable pipeline securitycontrols (SAST, dependency scanning, container image scanning, and infrastructure-as-codechecks) are implemented in DevSecOps CI/CD/CM pipelines; document the controls for the SSP and capture scan reports in the Evidence Index (RMF Step 3)
- Analyze code and pipeline findings for security weaknesses and verify that mitigation strategies are validated and sustained across the system lifecycle
- Perform risk identification and IT governance assessments throughout the CI/CD/CM pipeline; brief ISSOs on pipeline risks
- Support hardened-build verification for development and production systems and ad-hoc scanning requests
- Support agent, data ingest and sharing, and pipeline integration efforts
- Maintain scanning SOPs and runbooks; provide Tenable/Wiz evidence for control demonstrations during RMF Step 4
Skills
- * Five (5)+ years of cybersecurity or systems engineering experience, including two (2)+ years operating Tenable, Wiz, or a comparable enterprise vulnerability management platform
- * Hands-on experience with CI/CD tooling (GitLab CI, Jenkins, Azure DevOps, or GitHub Actions) and at least one SAST/SCA or container scanning tool (e.g., SonarQube, Fortify, Snyk, Trivy, Anchore, Prisma)
- * Scripting proficiency (Python, PowerShell, or Bash) and comfort with REST APIs
- * Active, final SECRET security clearance; U.S. citizenship
- * DoD 8140/8570 IAT Level II baseline certification (e.g., Security+ CE, CySA+, GSEC) or ability to obtain within 6 months
- * Working knowledge of NIST SP 800-53 Rev. 5 vulnerability and configuration management controls (RA-5, SI-2, CM-6, SA-11)
- Bachelor's degree in Computer Science, Information Technology, Cybersecurity, or a related field, or an additional four (4) years of directly relevant experience in lieu of degree
- Remote; must reside within the National Capital Region (NCR)
- Must be available during Department core hours of 9:00 a.m. - 3:00 p.m. ET, Monday - Friday, and flex working hours as needed to meet CST day-to-day and emergent requirements
- Participates in a rotating on-call schedule supporting 24x7x365 availability of the vulnerability and compliance scanning platforms
- Position requires an OpenNet account, DoS PIV badge, multifactor authentication, and adherence to DoS SBU/CUI handling requirements
- Local travel within the National Capital Region; minimal other travel
- * Tenable or Wiz certification; Certified DevSecOps Professional or equivalent
- * Experience with Kubernetes/containers, Terraform, and cloud (AWS/Azure) security
- * Department of State or other federal civilian experience; iPost familiarity
- * STIG/SCAP experience and DISA STIG Viewer proficiency
Benefits
- Health insurance
- Dental insurance
- Vision insurance
- Life insurance
- 401(k) with company matching
- Paid time off and holidays
- Employee referral program
- Educational assistance
- Remote work; selected candidate must reside within the National Capital Region (NCR)
- OneZero provides the laptop and collaboration tools
- No work is performed on Federal holidays or during Government closures
Company Overview