Lead Security Engineer B&A

Overview

Subject Matter Expert Lead Security Engineer to lead application security across a large-scale cloud-native federal modernization program supporting the U.S. Census Bureau’s Decennial Transformation and Application Modernization effort. Provide technical and management leadership on major security tasks, embedding security into every phase of the System Development Life Cycle using a DevSecOps methodology. Architect and enforce Zero Trust principles, drive Authorization to Operate activities, and direct application security testing, threat modeling, and vulnerability remediation across a System of Systems. Interface with senior Government stakeholders and the Office of Information Security, making decisions that impact overall program implementation.

What You'll Do12

• 1Lead the design and implementation of application security solutions, frameworks, and processes across all phases of the SDLC, in compliance with U.S. Census Bureau and Office of Information Security policies
• 2Implement Zero Trust principles for applications, workloads, and data, aligned with EO 14028, OMB M-22-09, and NIST SP 800-207
• 3Integrate security into DevSecOps CI/CD pipelines, establishing security gates, automated code inspection, and supply-chain controls including Software Bill of Materials generation
• 4Direct Static and Dynamic Application Security Testing, vulnerability assessments, and penetration testing to identify, triage, and remediate security weaknesses
• 5Lead threat modeling exercises to analyze application architecture, identify attack vectors, and document mitigation strategies throughout design, development, testing, and deployment
• 6Support the Authorization to Operate process, including security control assessment, artifact and evidence collection, Privacy Threshold Analysis support, and Plan of Action and Milestones management
• 7Implement security controls in accordance with the NIST Cybersecurity Framework and NIST SP 800-53, and remediate identified vulnerability and compliance findings
• 8Design and implement secure architecture patterns such as secure API design, authentication/authorization, input validation, encryption, secure logging and monitoring, and secure error/session/configuration management
• 9Develop and maintain metrics, dashboards, and reporting to track application security posture, threat trends, and remediation progress over time
• 10Support the development and management of Interagency Security Agreements, security playbooks, and incident response in accordance with current cybersecurity policies
• 11Collaborate with application developers, data engineers, systems engineers, and OIS to identify and mitigate vulnerabilities, and provide expert security consultation to development teams
• 12Assist in FedRAMP certification activities and the assessment/remediation of independent penetration testing results, as applicable

Salary Insight