Cybersecurity Engineer

Ashburn, VA onsite with an opportunity to support mission-critical operational technology and defense mission systems. This role provides cybersecurity engineering across the CBP OTOC and the ISS OTOC build-out, integration, and operations, helping teams move from mission needs to secure architectures, vulnerability management, and RMF-aligned authorization activities.

At Sherpa 6 , you will be part of a team that values both technical rigor and practical outcomes. The position includes a generous PTO policy plus comprehensive benefits for you and your family, along with strong retirement savings support.

Responsibilities

• Provide cybersecurity engineering support for integration, deployment, authorization, and sustainment of complex OTOC operational technology and mission systems.
• Translate mission, operational, and system requirements into actionable cybersecurity requirements and secure system architectures.
• Evaluate system designs, architectures, configurations, interfaces, and dependencies to identify cybersecurity risks, vulnerabilities, and attack surfaces.
• Integrate cybersecurity requirements into system design, development, testing, integration, deployment, and sustainment activities.
• Provide cybersecurity engineering guidance for applications, data platforms, tactical communications systems, mission networks, and authorized effectors.
• Collaborate with cross-functional engineering teams to resolve cybersecurity issues while maintaining mission performance, system availability, interoperability, and operational requirements.
• Perform vulnerability identification, analysis, prioritization, remediation, and tracking across applications, infrastructure, networks, and operational technology environments.
• Assess vulnerabilities in context of system architecture, mission impact, threat exposure, and operational risk.
• Analyze security findings and translate technical vulnerabilities into clear, actionable risk information for system owners, engineers, and program leadership.
• Develop and recommend risk mitigation strategies and support implementation of security controls and corrective actions.
• Support incident response activities including identification, analysis, investigation, containment, remediation, and recovery for cybersecurity incidents affecting mission systems and OT environments.
• Support post-incident analysis and lessons learned, incorporating findings into vulnerability management, security controls, system architecture, and risk mitigation activities.
• Support incident response exercises, technical investigations, and recovery activities as required.
• Support RMF activities across the system lifecycle, including security categorization, control implementation, assessment, remediation, and continuous monitoring.
• Support development, maintenance, and execution of Authorization to Operate (ATO) activities and associated authorization artifacts.
• Develop and maintain cybersecurity documentation, including risk assessments, security plans, POA&Ms, control assessments, vulnerability assessments, and ATO documentation.
• Support cybersecurity assessments, audits, inspections, and technical reviews tied to system authorization and operational deployment.
• Support continuous monitoring and ongoing authorization activities to ensure systems remain secure, compliant, operationally viable, and supportable.
• Serve as a technical cybersecurity advisor across systems engineering, software, infrastructure, operations, cybersecurity, and program leadership.
• Communicate cybersecurity risks, technical findings, and recommended courses of action to both technical and non-technical stakeholders.
• Stay current with applicable cybersecurity standards, RMF requirements, vulnerability management practices, emerging threats, and relevant technologies, applying them to risk-informed security decisions.

Requirements

• Must possess existing DHS EOD or DHS Suitability and be able to obtain and maintain suitability (as applicable).
• 5+ years of experience in cybersecurity engineering, information security, systems engineering, vulnerability management, or a closely related technical field.
• Bachelor’s degree in Cybersecurity, Computer Science, Information Systems, Systems Engineering, or a related technical discipline (equivalent directly relevant professional experience may be substituted).
• Demonstrated experience supporting mission-critical systems or environments with high availability, real-time communications, operational constraints, or other demanding performance requirements.
• Demonstrated experience with cybersecurity engineering, vulnerability management, risk assessment, and security architecture across complex systems, applications, infrastructure, networks, or operational technology environments.
• Experience supporting cybersecurity incident response, including incident analysis, investigation, containment, remediation, recovery, and post-incident activities.
• Experience applying FISMA , NIST cybersecurity standards and guidance, and the RMF to government information systems.
• Experience supporting systems through the security assessment and authorization/ATO lifecycle, including control implementation, assessment, remediation, authorization, and continuous monitoring.
• Experience developing and maintaining documentation such as System Security Plans (SSPs), POA&Ms, Security Assessment Reports (SARs), authorization evidence, system inventories, network diagrams, and data-flow diagrams.
• Demonstrated ability to analyze technical vulnerabilities and security findings, assess operational and mission impact, and develop risk-based remediation or mitigation strategies.
• Experience translating mission and operational requirements into cybersecurity requirements, security controls, and practical technical solutions.
• Experience working with system owners, engineers, authorizing officials, security leadership, program managers, and senior government stakeholders to resolve cybersecurity risks and support authorization decisions.
• Ability to communicate complex cybersecurity risks and technical findings clearly to both technical and non-technical audiences.

Preferred Qualifications

• Cybersecurity certification such as CISSP , CISM , Security+ , GSEC , or equivalent (equivalent demonstrated cybersecurity experience may be considered where permitted).
• Experience with government security authorization, RMF, vulnerability management, and continuous monitoring platforms and tools.
• Familiarity with security operations and monitoring technologies, including SIEM, EDR/XDR, IDS/IPS, threat intelligence, security analytics, and incident response platforms.
• Familiarity with Zero Trust architecture and identity-centric security, including IAM, PAM, endpoint security, threat detection, and access control.
• Experience supporting incident response exercises, tabletop exercises, after-action reviews, and remediation activities.
• Experience with cloud security and hybrid infrastructure, including AWS, Azure, or other government-authorized cloud environments.
• Experience integrating cybersecurity into DevSecOps, software development, CI/CD, or automated security testing environments.
• Experience assessing software, hardware, third-party, and supply-chain cybersecurity risks.
• Experience supporting FISMA reporting, federal cybersecurity assessments, agency cybersecurity policies, governance processes, and compliance activities.
• Experience developing or reviewing security architectures, system boundaries, system interconnections, attack surfaces, threat models, and cybersecurity requirements.

Technology Focus

• RMF, Authorization to Operate (ATO), FISMA, NIST
• System Security Plans (SSPs), Plans of Action and Milestones (POA&Ms), Security Assessment Reports (SARs)

Salary, Travel, and Screening

Salary range: USD 120,000 - 160,000 per year.

Travel requirement: less than 10%.

Background screening/check/investigation: successful completion will/may be required as a condition of hire.

Benefits

• Medical coverage for you and your family
• Dental and vision benefits
• Health and wellness benefits
• Generous retirement savings plan
• Generous PTO policy

Reasonable accommodations: Sherpa 6 will make reasonable accommodations in compliance with the Americans with Disabilities Act of 1990.

Equal opportunity: Sherpa 6 does not discriminate based on race, color, national origin, sex, religion age, disability, sexual orientation, gender identity, veteran status, height, weight, or marital status, and is an equal access/opportunity/affirmative action employer.