FIPS 140 Security Engineer

Job Description

Job Description

We are looking for a FIPS 140 Security Engineer to join the client’s Accredited Testing & Evaluation team supporting cybersecurity initiatives critical to national defense. This role focuses on evaluating, testing, and validating cryptographic products and security solutions against FIPS 140 and NIST standards. The role will perform security assessments, entropy analysis, vulnerability testing, cryptographic validation activities, and technical reporting within a hands-on laboratory environment supporting secure communications technologies.

The ideal candidate will have experience with cryptographic technologies, FIPS 140 validation processes, entropy assessments, scripting, and security testing methodologies.

Key Responsibilities:

·      Support FIPS 140 validation and security evaluation projects for cryptographic products and systems.

·      Perform security architecture reviews, product design analysis, and system-level security assessments.

·      Conduct cryptographic and Public Key Infrastructure (PKI) testing.

·      Analyze entropy sources in accordance with NIST SP 800-90B requirements and evaluate SP 800-90C random bit generator constructions.

·      Perform statistical and heuristic analysis of noise datasets.

·      Create and review Entropy Assessment Reports (EAR) and Public Use Documents (PUD).

·      Prepare and submit Entropy Source Validation (ESV) packages through the NIST ESVTS platform.

·      Conduct vulnerability assessments, logical security analysis, and physical security testing.

·      Review source code and develop scripts or tools to automate testing activities.

·      Build testing environments, execute test plans, document findings, and produce technical reports.

·      Evaluate products against applicable security standards and technology-type requirements.

Core Qualifications:

·      Bachelor's degree in Computer Science, Cybersecurity, Computer Engineering, Information Systems, or a related field.

·      2+ years of relevant cybersecurity, cryptographic testing, security engineering, or validation experience.

·      Knowledge of cryptographic encryption algorithms, key exchange protocols, hashing algorithms, message authentication techniques, PKI, and random number generators.

·      Strong understanding of NIST SP 800-90A, SP 800-90B, and SP 800-90C standards.

·      Experience performing entropy source analysis and validation activities.

·      Experience with one or more programming languages including Python, C, C++, or Java.

·      Experience developing scripts or automation tools to support testing activities.

·      Familiarity with SSH, TLS, IPsec, and other security-related protocols.

·      Experience building test environments, executing security testing, and documenting results.

·      Knowledge of networking fundamentals, including subnetting and routing concepts.

·      Strong troubleshooting, analytical, and problem-solving abilities.

·      Ability to interpret security standards and apply requirements to products and systems.

·      Strong written communication skills and technical documentation experience.

Preferred Qualifications:

·      Cryptographic Validation Program (CVP) Certification.

·      Advanced Python development experience.

·      Experience with debugging tools such as ADB, WinDBG, or Visual Studio.

·      Experience performing statistical analysis of entropy sources.

·      Knowledge of OpenSSL, OpenPGP, and cryptographic libraries.

·      Vulnerability assessment or penetration testing experience.

·      Knowledge of Active Directory and Linux administration.

·      Experience with X.509 certificate validation.

·      Hands-on experience using laboratory equipment such as oscilloscopes, function generators, multimeters, or signal generators.

·      Industry certifications such as CCNA, CCNP, CCIE, JNCIA, JNCIS, JNCIP, or JNCIE.

·      Strong understanding of computer security principles, cybersecurity best practices, and secure product development.