Information Systems Security Engineer

Tysons, VATS/SCI with PolyAt Bcore, our strength comes from how we deliver impact to the mission. Whether it’s architecting critical IT solutions, producing actionable intelligence, or developing cutting edge technology, we succeed because of the expertise, collaboration, and agility of our teams. Our Mission Services division combines enterprise IT, cloud solutions, DevSecOps, systems engineering, software development, and operational support. Bcore accelerates decisive advantage for warfighters and intelligence professionals by fusing human insight, rapid-fire engineering, precision-measured outcomes, and relentless grit into mission-ready solutions.Do you want to join a team that is building tailored technical solutions to modernize our government’s mission and our client’s business? Do you have a desire to change how people work? Are you interested in helping to protect our nation’s cyber interests? Join our growing team supporting customer missions as a Information Systems Security Engineer in Tysons, Virginia.The ISSE will lead and execute security engineering activities across complex, enterprise-scale environments. This role requires deep technical expertise across infrastructure, platforms, and applications, combined with expert-level, hands-on experience implementing the NIST Risk Management Framework (RMF) within federal government environments. The ideal candidate is a technical practitioner, not just an advisor - someone who can design, implement, assess, and secure systems end-to-end while directly supporting system authorization, continuous monitoring, and risk-based decision-making. This role also serves as the technical focal point for all security incidents, leading triage, investigation, and resolution efforts in coordination with program and enterprise security teams.Serve as the Cyber Security Engineer SME, providing hands-on security engineering across all system layers (infrastructure, platform, and application)Engineer, implement, and validate security controls in accordance with NIST SP 800-53 and RMF requirementsLead and support RMF lifecycle activities (Categorize, Select, Implement, Assess, Authorize, Monitor)Perform security engineering forNetwork architectures and boundary protectionsWindows and Linux operating systemsStorage and virtualization platformsDatabases and data platformsWeb services, APIs, and application stacksCustom and COTS/GOTS software solutionsProvide technical input to RMF artifacts, includingSystem Security Plans (SSP)Security Control Assessments (SCA) supportPOA&MsRisk assessments and security impact analysesCollaborate with system owners, architects, developers, ad operations teams to embed security into system design and implementationSupport ATO, re-authorization, and continuous monitoring activitiesIdentify security risks and provide practical, technically sound mitigation strategiesParticipate in security reviews, technical design reviews, and vulnerability remediation effortsServe as technical l point of contact for all security incidents affecting the programLead triage and analysis of new security alerts from SIEM, IDS/IPS, and other security monitoring toolsDrive remediation efforts for recurring security alerts, identifying root causes and implementing systemic fixesCoordinate incident response activities between program stakeholders and enterprise security operationsAct as primary liaison between program teams and enterprise security for incident escalation, resolution, and reportingPerform forensic analysis and technical investigations of security eventsDocument security incidents, response actions, and lessons learnedDevelop and maintain runbooks and playbooks for common security incident typesRequired Qualifications Proven hands-on Cyber Security Engineer SME, not policy-only or audit-onlyComfortable working across network, system, platform, and application layersDeep understanding of how security controls are actually implemented and validatedExperience in federal RMF-driven environmentsAble to bridge security, engineering, and compliance effectivelyExperienced in managing security incidents from detection through resolutionSkilled at balancing immediate incident response needs with long-term security improvementsEffective collaborator across organizational boundaries during high-pressure security eventsOperate independently as the technical authority for system security engineeringDemonstrate the ability to provide technical hands-on configuration, validation, and assessment of security controlsTranslate RMF and NIST requirements into real-world technical implementationsCommunicate complex technical security issues clearly to both technical and non-technical stakeholdersMaintain a strong balance between security compliance and operational practicalityLead rapid response to security incidents with minimal guidanceDemonstrate strong analytical and troubleshooting skills under pressure during active security eventsEffectively communicate incident status, impact, and remediation progress to technical and leadership audiencesExpert-level experience with NIST Risk Management Framework (RMF) in federal government environments (NIST SP 800-37, NIST SP 800-30, NIST SP 800-53)Direct involvement I ATO packages, control implementation, and assessmentsHands-on experience with Security Information and Event Management (SIEM) platforms (e.g., Splunk, ELK Stack, ArcSight, QRadar)Demonstrated experience in security incident detection, analysis, and responseProven ability to triage security alerts and determine criticality and impactInfrastructure & Platforms (Hands-On)Networking (e.g., routing, switching, firewalls, load balancers, network security controls)Operating Systems Linux (RHEL, CentOS), Windows ServerVirtualization and storage platformsDatabases (SQL and/or NoSQL)Data platforms (e.g., HPCC, Hadoop/Cloudera) Web services, APIs, and application architecturesSoftware development environments and CI/CD pipelinesSecurity tooling (e.g., vulnerability scanners, endpoint protection, SIEM)Engineering ExperienceSecurity engineering and system hardeningVulnerability discovery and remediationSecure system design and architecture reviewsTechnical documentation supporting RMF complianceExperience in cloud environments (AWS, Azure, GCP, CI) within federal RMF contextsExperience with DevSecOps practicesBCore is proud to be an equal opportunity workplace. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, national origin, disability status, protected veteran status, sexual orientation or any other characteristic protected by law.