Note: The job is a remote job and is open to candidates in USA. Sphera is a global provider of enterprise software and services for environmental, health, safety, and sustainability management. The Cybersecurity Engineer will serve as a security subject-matter expert within the DevOps squad, managing compliance for software deployed in federal and DoD environments. The role focuses on RMF/ATO lifecycle management, STIG implementation, vulnerability remediation, incident response, and DevSecOps integration.
Responsibilities
- Lead cybersecurity for software deployed in secure federal and DoD environments, ensuring compliance with applicable government security policies, access requirements, and accreditation expectations
- Execute RMF activities, including system categorization, security control selection, implementation, assessment, and ATO documentation for federal or DoD-hosted systems
- Implement, configure, and validate STIGs across layers using DISA-approved or equivalent government security tooling
- Mitigate OWASP Top 10 and application-layer vulnerabilities across services
- Monitor security controls, scan vulnerabilities, and audit systems, producing reports and coordinating remediation with development and DevOps
- Manage POA&Ms, coordinating with government security stakeholders, ISSMs, and internal teams to track and resolve open findings
- Support FedRAMP and FISMA compliance, aligning controls with NIST SP 800-53 Rev. 5
- Integrate security tooling and automated checks into CI/CD pipelines, advancing DevSecOps maturity
- Collaborate with engineers and the Principal Solutions Architect to conduct threat modeling, security design reviews, and application-level security assessments
- Maintain System Security Plans (SSPs), security architectures, and supporting ATO documentation packages in alignment with federal and DoD requirements
- Lead incident response activities for security events affecting systems deployed in secure government environments, coordinating with customer cybersecurity personnel and internal stakeholders
- Monitor SIEM alerts, analyze logs, and investigate anomalous activity
- Evaluate the security posture of third-party integrations, vendor tools, and emerging technologies for adoption in secure federal or DoD environments
- Embed security requirements into sprint planning, feature development, and release processes with the TPM, engineering squads, and product owners
- Stay informed on evolving federal, DoD, DISA, and agency-specific security policies, DISA guidance updates, and emerging threats, and proactively communicate their impact to the engineering organization
Skills
- U.S. citizen required; active DoD security clearance or ability to obtain and maintain one due to secure federal enclave access
- Minimum 3-5 years of hands-on cybersecurity experience in a federal, DoD or similarly regulated secure environments
- Strong working knowledge of secure federal or DoD environments, including segmented networks, access control, approved software baselines, and applicable security requirements
- Experience supporting or leading RMF processes, including ATO package preparation and submission for federal or DoD systems
- Proficiency in applying STIGs using DISA-approved tools (SCC, STIG Viewer, Nessus/ACAS) or comparable vulnerability and compliance platforms
- Solid understanding of FedRAMP Moderate and FISMA compliance, with ability to map security controls to NIST SP 800-53 Rev. 5
- Experience with vulnerability management tools (e.g., Tenable.sc, Nessus, ACAS) in federal or DoD environments
- Familiarity with enterprise security tools including SIEM, IDS/IPS, and network security controls
- DevSecOps experience, including integrating SAST, DAST, and SCA scanning into CI/CD pipelines using Azure DevOps, Jenkins, or equivalent tools
- Familiarity with PKI, CAC/PIV authentication, and certificate management in federal or DoD environments
- Strong written and verbal communication skills to translate complex security findings into actionable guidance for engineering teams and brief government stakeholders
- DoD 8570/8140 compliant certification at IAT Level II or higher (e.g., CompTIA Security+, CISSP, CEH, CAP, or equivalent)
- Bachelor's degree in Computer Science, Information Security, Cybersecurity, or a related field, or equivalent practical experience
- Experience working in segmented networks with an understanding of federal, DoD, or similarly regulated infrastructure and security requirements
- Proven time management, organizational and follow-up skills to meet deadlines
- Work effectively, independently, and in a dynamic team environment
- Excellent interpersonal skills
- Must be willing to learn new technologies and processes as needed
Benefits
- Medical, Dental, and Vision Insurance
- Health Savings Account
- Flexible Spending Account
- 401(k) Retirement Plan with Company Match
- Life and Disability Insurance
- Critical Illness Insurance
- Accident Insurance
- Hospital Indemnity Insurance
- Paid Time Off and Holidays
- Flexible Working Schedule
- Eligible for Variable Compensation Plan
Company Overview