Cyber Systems Engineer with Security Clearance

Cyber Systems Engineer $100,000 - $117,000 | Location: Colorado Springs, CO | Active Secret Clearance Required Support cybersecurity engineering and Risk Management Framework (RMF) activities for mission-critical defense systems. This role focuses on security compliance assessments, vulnerability identification, security control validation, RMF documentation, and Assessment and Authorization (A&A) support. Working alongside engineering teams, program personnel, and Government stakeholders, the Cyber Systems Engineer will help maintain secure system configurations, address compliance deficiencies, and support the authorization and continued operation of systems in regulated defense environments. A Day in the Life - What youll do

• Assess systems and networks to identify deviations from approved configurations, enclave policies, security baselines, and local security requirements.
• Perform security compliance evaluations using tools such as STIG Viewer, SCAP, Evaluate-STIG, STIG Manager, and other applicable compliance assessment technologies.
• Author, update, and review security testing documentation, including security assessment plans, test cases, and cybersecurity test methodologies.
• Conduct annual security control assessments and support continuous monitoring activities to verify that security controls remain effective.
• Provide technical input for Security Assessment Reports (SARs), Risk Assessment Reports (RARs), and other cybersecurity assessment deliverables.
• Coordinate with the programs System Program Office (SPO) contractor and Government personnel to maintain accurate system records in the Enterprise Mission Assurance Support Service (eMASS).
• Collect, prepare, organize, and maintain the RMF body of evidence, including documentation of operational processes, procedures, and site-specific security requirements.
• Prepare and update RMF artifacts supporting Assessment and Authorization (A&A), including Plans of Action and Milestones (POA&Ms).
• Review RMF documentation and security artifacts to identify gaps, inconsistencies, and deviations from applicable security control requirements.
• Support implementation of Government cybersecurity policies and standards, including NISPOM, NIST, DoD, and Air Force instructions, as applicable.
• Establish and maintain program control processes that support risk mitigation, security compliance, and system authorization.
• Assist with control certification testing, compliance documentation, technical investigations, software research, hardware introduction and release activities, emerging technology research, inspections, and periodic audits.
• Analyze established cybersecurity controls and requirements to validate their effectiveness and recommend appropriate safeguards.
• Coordinate with program stakeholders to investigate and resolve deficiencies identified during RMF assessments.
• Support vulnerability management, system hardening, and remediation activities to improve the security posture of systems and networks.
• Collaborate with cybersecurity engineers, system administrators, software teams, and Government representatives to maintain compliance with security requirements.
• Maintain clear technical documentation and communicate assessment results, identified risks, and recommended corrective actions to relevant stakeholders.
• Level 3 engineers will take on greater responsibility for complex assessments, RMF artifact reviews, deficiency resolution, and coordination of cybersecurity activities across the program. Required Qualifications
• Bachelors degree and 5 years of relevant work experience; OR
• Masters degree and 3 years of relevant work experience; OR
• PhD and 1 year of relevant work experience. All Levels
• Active U.S. Government Secret security clearance, current and within scope, at the time of application.
• Current DoD 8570.01M IAT Level II certification, such as Security+ CE, CCNA Security, GSEC, or SSCP.
• Experience in cybersecurity or security engineering, including cybersecurity principles, risk management, security assessments, vulnerability management, and/or system hardening.
• Experience with cybersecurity frameworks, standards, tools, or technologies used to assess and secure information systems.
• Ability to evaluate security requirements, identify compliance deficiencies, and support the development of corrective actions.
• Ability to prepare and maintain technical documentation and communicate cybersecurity findings to engineering teams and stakeholders.

Preferred Qualifications

• Working knowledge of cybersecurity technologies and DoD/Federal cybersecurity policy, including DoDI 8500.01, NIST SP 800-53, and NIST SP 800-115.
• Familiarity with the Risk Management Framework (RMF) cybersecurity lifecycle, including development of testable security controls and assessment procedures.
• Experience conducting vulnerability and compliance scans using Assured Compliance Assessment Solution (ACAS), Nessus, or Tenable.sc.
• Linux system administration experience.
• Experience implementing Security Technical Implementation Guides (STIGs) and hardening system configurations.
• Bachelors degree in a STEM discipline with 8 years of cybersecurity engineering and/or testing experience; or 7 years of experience with a masters degree; or 4 years of experience with a PhD. Relevant experience may be considered in lieu of a degree.
• Penetration testing certifications such as OSCP, OSCE, GPEN, GWAPT, or GXPN.
• Experience using or configuring Security Information and Event Management (SIEM) and log aggregation software.
• Experience conducting cybersecurity assessments of Red Hat Enterprise Linux (RHEL) environments.
• Understanding of networking concepts, including subnetting, firewalls, Network Address Translation (NAT), Access Control Lists (ACLs), and VLANs.
• Familiarity with STIG/SCAP compliance scanning using tools such as SCAP Compliance Checker (SCC), Evaluate-STIG, STIG Manager, and Xylok.
• Experience automating security scanning and compliance activities using Ansible or Python.
• Familiarity with Agile development methodologies, including Scrum, Kanban, or SAFe.
• Experience with Jira and other Atlassian tools.
• VMware and containerization experience.
• Experience with eMASS and Assessment and Authorization (ATO) processes.
• Experience with the Elastic Stack.
• Cross-Domain Solution (CDS) experience, including authorization activities and coordination with the Cross-Domain Support Element (CDSE) and National Cross Domain Strategy & Management Office (NCDSMO).
• DoD IAT Level III certification, such as CISSP.
• Ability and willingness to travel CONUS and OCONUS up to 25%. Who is Caribou Thunder? Caribou Thunder is a HUBZone-certified small business providing advanced technical and engineering services to the U.S. Department of War and its mission partners. 35+ states and 20+ countries. We've delivered trusted solutions for over two decades - strengthening national readiness across missions on land, undersea, in the air, and throughout LEO, MEO, GEO, and deep space. Why Caribou Thunder? TEAM THUNDER - Mission Focused. Delivery Proven. Ready to Serve. Employee Advocacy | Mission Proven | Global Reach | Skilled Teams | Modern Tools | Empowering Culture Our engineers and innovators ensure capability from sea floor to space frontier - delivering on time, maintaining compliance, and performing with precision in high-consequence environments. We specialize in Engineering Services, Cybersecurity, Software Development, Modeling & Simulation, Digital Engineering, and Artificial Intelligence - disciplines powering the nation's most complex technical missions. Employee Advocacy + Benefits Our people are the heart of Caribou Thunder. We invest in their growth, flexibility, and well-being - knowing their success drives ours. Benefits include:
• Premium Health, Dental & Vision Insurance
• 401(k) with 6% Company Match
• Flexible PTO & Work Schedule
• Education & Certification Reimbursement
• Support for Military Leave
• Work-Life Balance & Traditional Family Values Your future, your flexibility, your well-being - we invest in you. Apply and let's connect.