Security Automation / Cyber Security Engineer

Accountabilities: Design, develop, and maintain automated workflows for collecting security and compliance evidence from system, infrastructure, configuration, and security data sources. Build automation for security control assessments and continuous monitoring, including machine-readable evidence collection and assessment capabilities using the Open Security Controls Assessment Language (OSCAL). Develop integrations and data pipelines that aggregate, normalize, and organize security information from APIs, cloud platforms, CI/CD pipelines, and security tools. Create and maintain security dashboards and metrics that provide timely visibility into security posture, control coverage, vulnerabilities, remediation progress, and compliance status. Automate recurring security and compliance reports for engineering teams, cybersecurity professionals, program leadership, and government stakeholders. Develop methods to measure security control implementation and security tooling coverage across applications, infrastructure, and continuous integration and delivery pipelines. Automate vulnerability and remediation reporting, including prioritization, ownership assignment, aging analysis, and tracking issues through resolution. Support the implementation and ongoing operation of Software Bill of Materials (SBOM) capabilities, including the collection and analysis of software dependencies and third-party components. Integrate software supply-chain information with vulnerability management processes to identify and assess risks associated with software dependencies and external components. Collaborate with DevSecOps engineers to ensure security controls embedded in CI/CD pipelines and infrastructure produce consistent, reusable, and auditable compliance evidence. Identify repetitive manual security activities that can be automated and implement scalable solutions to improve efficiency and reduce operational overhead. Establish repeatable processes that enable product and engineering teams to demonstrate ongoing compliance with applicable security standards. Ensure that automated evidence, security metrics, and reporting processes are traceable, maintainable, and suitable for continuous monitoring and independent security assessments. Document automation workflows, technical integrations, data sources, and implementation procedures to support long-term maintenance by platform security teams. Work closely with security engineers, Risk Management Framework (RMF) specialists, software engineers, product teams, and government stakeholders to improve cybersecurity operations and support sustainable compliance. Requirements An associate degree and at least four years of relevant experience, or a bachelor's degree and at least two years of relevant experience. Alternatively, five years of experience as a Cyber Security Engineer may substitute for a degree. Practical experience developing automation using Python, JavaScript, or another scripting or programming language. Experience integrating and processing data from APIs, cloud environments, CI/CD systems, security tools, or other technical platforms. Experience designing or implementing automated workflows, data pipelines, dashboards, security metrics, or reporting solutions. Working knowledge of cybersecurity principles, including security controls, vulnerability management, continuous monitoring, and regulatory compliance. Familiarity with modern software development practices and CI/CD workflows. Strong analytical skills, with the ability to interpret complex security and technical data and translate findings into actionable insights and meaningful performance metrics. Excellent written and verbal communication skills, with the ability to collaborate effectively across security, engineering, product, and program teams. Ability to obtain and maintain the background investigation approval and system access required to support Department of Veterans Affairs environments. US citizenship or permanent resident status, as required for this position. Preferred qualifications: Experience supporting federal cybersecurity programs or systems governed by the NIST Risk Management Framework (RMF); knowledge of NIST SP 800-53 Revision 5 security controls; and familiarity with federal Authority to Operate (ATO) processes, Plans of Action and Milestones (POA&Ms), control implementation evidence, and independent security assessments. Additional preferred expertise: Experience with OSCAL or other machine-readable compliance frameworks; automated security evidence collection; continuous monitoring; and security assessment workflows. Cloud and application security experience: Familiarity with AWS security services such as Security Hub and GuardDuty, as well as GitHub Actions or comparable CI/CD platforms. Security tooling knowledge: Experience with Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), Software Composition Analysis (SCA), secrets detection, container scanning, or similar application security technologies. Software supply-chain security: Experience with SBOM standards and tools, software dependency analysis, and third-party component risk management. Reporting and platform experience: Experience building security posture, vulnerability management, or compliance dashboards, ideally in large-scale cloud environments supporting multiple product and engineering teams. Work arrangement: Ability to work remotely from within the United States, maintain reliable internet connectivity, and work standard Monday-to-Friday business hours. Occasional extended or weekend hours may be necessary to meet operational requirements, and limited travel may be required for customer meetings or industry events. Benefits Competitive annual salary: Base salary ranging from $135,000 to $160,000 , depending on geographic location, relevant experience, skills, education, internal equity, security clearance considerations, and contract requirements. Medical coverage: Medical, dental, and vision insurance. Health Savings Account (HSA): Access to an HSA with employer contributions when enrolled in an eligible health plan. Life and disability insurance: Employer-paid life insurance, accidental death coverage, and short-term and long-term disability benefits. Additional insurance options: Voluntary accident, hospital indemnity, and critical care insurance. Flexible spending accounts: Voluntary healthcare and dependent care Flexible Spending Accounts (FSAs). Paid time off: Accrued paid leave and company-paid holidays. Retirement savings: Access to a 401(k) retirement plan with employer matching contributions. Remote work flexibility: A remote position based in the United States, offering the convenience of working from home. Mission-driven work: The opportunity to contribute to the modernization and security of government digital services that support important public-sector programs. Technical and professional growth: Hands-on experience with security automation, cloud technologies, DevSecOps, compliance engineering, vulnerability management, and software supply-chain security. Collaborative environment: Opportunities to work alongside multidisciplinary teams focused on scalable technology, operational excellence, and sustainable cybersecurity improvements.