Cybersecurity Engineer / Information System Security Engineer (ISSE) – DoD Healthcare

Overview

Support cybersecurity engineering, system authorization, compliance, and continuous monitoring of enterprise healthcare technology solutions supporting the Department of Defense (DoD) and Defense Health Agency (DHA).

What you'll do

• Support cybersecurity engineering throughout system design, development, integration, deployment, and sustainment of Salesforce Health Cloud, Amazon Connect, and associated cloud services.
• Develop, maintain, and coordinate required DoD/DHA ATO and Risk Management Framework (RMF) documentation, including System Security Plans (SSPs), security control implementation narratives, security boundary diagrams, data flow diagrams, and supporting authorization artifacts.
• Prepare and maintain security control responsibility matrices, hardware/software inventories, ports and protocols documentation, interconnection agreements, and Plans of Action and Milestones (POA&Ms).
• Coordinate with government Information System Security Managers (ISSMs), Information System Security Officers (ISSOs), security assessors, and Leidos cybersecurity personnel throughout the authorization process.
• Review system architectures, integrations, cloud configurations, and application designs to identify cybersecurity requirements, risks, and potential compliance gaps.
• Support implementation and validation of NIST SP 800-53 security controls, secure configuration baselines, access controls, encryption, logging, and monitoring capabilities.
• Evaluate cloud service security requirements, inherited controls, shared responsibility models, and authorization boundaries for Salesforce, AWS, and associated services.
• Coordinate vulnerability assessments, security scanning, configuration reviews, and remediation activities across system components.
• Track cybersecurity findings, vulnerabilities, POA&Ms, and corrective actions through validation and closure.
• Support continuous monitoring activities, including security control assessments, audit log reviews, vulnerability reporting, and compliance documentation.
• Conduct security impact assessments for application enhancements, configuration changes, new integrations, and software releases.
• Collaborate with developers and administrators to implement secure development practices and remediate application security vulnerabilities.
• Support security incident investigation, response coordination, evidence collection, and corrective action activities in accordance with approved procedures.
• Maintain accurate security documentation, authorization evidence, compliance records, and technical security procedures.
• Communicate cybersecurity risks, authorization status, compliance findings, and remediation progress to program management and government stakeholders.

What you'll need

• Bachelor's degree in Cybersecurity, Computer Science, Information Technology, Information Systems, Engineering, or a related technical discipline and 4–8 years of relevant experience, or a master's degree with 2–6 years of relevant experience.
• Equivalent experience may be considered in accordance with Leidos policies.
• At least 3 years of experience in cybersecurity engineering, information assurance, system security engineering, or security assessment and authorization activities.
• Demonstrated experience supporting DoD Risk Management Framework (RMF) processes and preparing or maintaining system authorization documentation.
• Experience developing System Security Plans, security control implementation narratives, POA&Ms, and supporting ATO artifacts.
• Working knowledge of NIST SP 800-53 security controls, DoD cybersecurity policies, and system authorization requirements.
• Experience reviewing technical architectures, system configurations, data flows, and security control implementations.
• Familiarity with cloud security principles, shared responsibility models, identity and access management, encryption, logging, and vulnerability management.
• Experience reviewing vulnerability assessment results, tracking remediation activities, and supporting continuous security monitoring.
• Strong analytical, problem-solving, technical documentation, communication, and collaboration skills.
• Ability to independently manage cybersecurity engineering assignments and coordinate with developers, administrators, cybersecurity personnel, and government representatives.
• Ability to meet applicable DoD/DHA personnel security and suitability requirements.
• Ability to satisfy applicable DoD cybersecurity workforce qualification requirements for the assigned position.

Nice to have

• Experience supporting ATO activities for DoD, DHA, VA, or other federal healthcare systems.
• Experience preparing authorization packages for cloud-hosted or SaaS-based enterprise applications.
• Familiarity with Salesforce Government Cloud Plus / Government Cloud Plus – Defense security architecture.
• Experience with AWS GovCloud, Amazon Connect, AWS IAM, CloudTrail, CloudWatch, and associated AWS security capabilities.
• Experience supporting DoD IL4/IL5 environments and understanding of the DoD Cloud Computing

Details

• Remote/Teleworker, United States.
• During the interview, candidates will be required to keep their camera on, and the interviewer will take a picture for identification purposes if an offer letter is extended.