MBL Technologies Inc. logo
MBL Technologies Inc.

Digital Solutions, Risk Management, Compliance & Advisory, and Management Consulting

Cybersecurity Policy Subject Matter Expert, SME

Security EngineerSecurity EngineerFull TimeRemoteLeadTeam 11-50H1B No SponsorCompany SiteLinkedIn

Location

United States

Posted

49 days ago

Salary

0

Seniority

Lead

Bachelor Degree10 yrs expEnglishCyber Security

Job Description

Cybersecurity Policy Subject Matter Expert, SME

MBL Technologies Inc.

• Track and analyze cybersecurity policy updates and directives from NIST, OMB, HHS, Cybersecurity and Infrastructure Security Agency (CISA), and other sources. • Lead the review and update of agency cybersecurity policies. • Perform gap analyses between current policies and new/revised federal requirements and develops remediation recommendations. • Develop implementation plans and rollout strategies for new or updated policies. • Draft policy memos, white papers, and briefings for both technical and non-technical audiences. • Support the development of security control overlays and tailored baselines aligned with the NIST RMF. • Advise agency leadership and program offices on cybersecurity policy interpretation and compliance. • Assist with the Federal Information Security Modernization Act (FISMA) reporting and audit support related to policy compliance. • Participate in working groups, policy review boards, and governance meetings. • Develop briefings and status updates on cybersecurity policy trends and contractor.

Job Requirements

  • 10 years of cybersecurity policy development experience in a federal setting.
  • Experience reviewing and writing enterprise-level security policies for a federal agency.
  • Working knowledge of the NIST SP 800 series (especially 800-53 Rev. 5 and 800-37)
  • Experience with FISMA compliance, continuous monitoring, and Security Assessment and Authorization (SA&A) processes.
  • Familiarity with Executive Orders, OMB Memoranda (e.g., M-22-09 Zero Trust), and CISA Binding Operational Directives.
  • Strong writing and editing skills; ability to take complex policy concepts and put them into plain language.
  • Certified Information Systems Security Professional (CISSP), Certified Information Security Manager (CISM), or CompTIA Cybersecurity Analyst (CySA+) (highly desired).
  • US citizenship (required)
  • BA/BS degree
  • Public Trust Clearance or the ability to obtain a clearance.

Benefits

  • robust benefits package (medical, dental, vision, STD, Accident, Life, Hospital Insurance, FSA, HSA, 401K match, professional development stipend, etc.)
  • employee discounts
  • learning and development reimbursement

Related Categories

Related Job Pages

More Security Engineer Jobs

Full TimeRemoteTeam 1,001-5,000Since 2004H1B Sponsor

Company Description Arista Networks is an industry leader in data-driven, client-to-cloud networking for large data center, campus and routing environments. What sets us apart is our relentless pursuit of innovation. We leverage the latest advancements in cloud computing, artificial intelligence, and software-defined networking to provide our clients with a competitive edge in an increasingly interconnected world. Our solutions are designed to not only meet the current demands of the digital landscape but to also anticipate and adapt to future challenges. At Arista we value the diversity of thought and perspectives that each employee brings to the table. We believe that fostering an inclusive environment, where individuals from various backgrounds and experiences feel welcome, is essential for driving creativity and innovation. Our commitment to excellence has earned us several prestigious awards, such as Best Engineering Team, Best Company for Diversity, Compensation, and Work-Life Balance. At Arista, we take pride in our track record of success and strive to maintain the highest standards of quality and performance in everything we do. Job Description Who You’ll Work With Our team's mission is to build the automations and tooling that power superhuman threat detection, incident response, and compliance reporting for both Arista's internal teams and our managed service customers. We are the engineering engine behind the security experts, creating the integrated, automated platform that allows them to move faster and see further As a Cybersecurity Software Engineer, you will be a critical part of a small, agile team responsible for the full lifecycle of these tools. You'll help evolve and enhance our sophisticated suite of MSSP tools and automations for a 24x7x365 managed service,ensuring our platform remains best-in-class. This is a hands-on role where you'll have the autonomy to design, build, and deploy solutions that have a direct impact on our security posture. What You'll Do ● Develop and maintain full-stack applications, including Node.js/Express backends and React frontends. ● Build robust scripts, custom modules, and powerful automations using Python. ● Own features and projects from design to deployment, working closely with security analysts to gather requirements and feedback. ● Integrate a wide array of security tools with our SIEM, SOAR, and centralized logging solutions to create a seamless operational workflow. ● Use, maintain, and enhance our CI/CD pipelines (GitHub Actions, Jenkins) with an "infrastructure as code" mindset. ● Ensure the quality and reliability of our tools by writing comprehensive unit and integration tests. ● Create clear and concise documentation, including READMEs, development guides, and user manuals. Qualifications - 3-5+ years of professional full-stack software development experience - Proficiency in Python, JavaScript/TypeScript, and modern frameworks (React, Node.js) - Experience with cloud platforms (GCP, AWS), containerization (Docker, Kubernetes), and CI/CD tools (GitHub Actions, Jenkins) - Expertise with databases including PostgreSQL, Elasticsearch, and Redis - Strong communication skills, able to explain complex technical concepts to non-technical stakeholders Bonus Points (Preferred Qualifications) ● Experience applying AI/ML to solve real-world problems, particularly with generative AI platforms (e.g., Google Gemini, AWS Bedrock) and concepts like RAG, vector databases, and embeddings frameworks. ● A strong background in cybersecurity, such as network/endpoint forensics, penetration testing (red team), or defensive engineering (purple team). ● Deep familiarity with security concepts like Indicators of Compromise (IOCs), CVEs, and the MITRE ATT&CK framework. ● Experience integrating with cybersecurity vendor and threat intelligence provider APIs. ● Experience building metrics dashboards to visualize performance and operational data. #LI-SZ1 Additional Information Arista stands out as an engineering-centric company. Our leadership, including founders and engineering managers, are all engineers who understand sound software engineering principles and the importance of doing things right. We hire globally into our diverse team. At Arista, engineers have complete ownership of their projects. Our management structure is flat and streamlined, and software engineering is led by those who understand it best. We prioritize the development and utilization of test automation tools. Our engineers have access to every part of the company, providing opportunities to work across various domains. Arista is headquartered in Santa Clara, California, with development offices in Australia, Canada, India, Ireland, and the US. We consider all our R&D centers equal in stature. Join us to shape the future of networking and be part of a culture that values invention, quality, respect, and fun.

Poland
Job Closed
Rapid7 logo

Senior Security Consultant, Emergent Threat – Exploit Researcher

Rapid7

At Rapid7, our vision is to create a secure digital world for our customers, our industry, and our communities. We do this by harnessing our collective expertise and passion to challenge what’s possible and drive extraordinary impact. We’re building a dynamic and collaborative workplace where new ideas are welcome. Protecting 11,000+ customers against bad actors and threats means we’re continuing to push the envelope - just like we’ve been doing for the past 20 years. If you’re ready to solve some of the toughest challenges in cybersecurity, we’re ready to help you take command of your career. Join us.

Full TimeRemoteTeam 1,001-5,000Since 2000H1B Sponsor

• Deliver Rapid7’s Vector Command Continuous Red Teaming service • Investigate emerging threats and breach customer perimeter defenses • Collaborate closely with a team of Red Team operators • Analyze, develop, and exploit N-day and newly released zero-day vulnerabilities • Develop and maintain positive relationships with clients, translate technical concepts • Mentor and coach junior staff

United Kingdom
Job Closed
Salutem Careers logo

Education Systems Officer

Salutem Careers

Salutem Care and Education is dedicated to protecting and promoting the well-being of children, young adults, and vulnerable individuals. As part of our safer recruitment process, the successful candidate will be required to complete thorough pre-employment checks, including an enhanced DBS and, where applicable, overseas criminal record checks.

Role Description Are you passionate about education and digital systems? Do you enjoy helping teams get the best out of technology? We’re looking for an Education Systems Officer to play a key role in supporting and improving the digital systems used across our education services. In this hands-on role, you’ll work closely with education leaders and central teams to ensure our Management Information Systems (such as Arbor and Databridge), safeguarding, assessment and care systems are used effectively, consistently and compliantly. You’ll support system implementation for new services, deliver engaging training, improve data quality, and help drive digital transformation across the organisation. Responsibilities - Overseeing and improving the use of education systems and MIS across multiple sites - Supporting system implementation, onboarding and data migration for new services - Delivering training and ongoing user support to staff with varying technical confidence - Promoting best practice, consistency and high-quality data for reporting and compliance - Working with systems such as Arbor, Databridge and Nourish Better Care Qualifications - Experience supporting or implementing digital systems within education, care or similar environments - Confidence delivering training and supporting users at all levels - Strong communication skills and a practical, solutions-focused mindset - A good understanding of education processes, data quality and compliance (GDPR) - Willingness to travel UK-wide when required Benefits - Emotional Support: 24/7 Employee Assistance, mental health resources, meditation apps, and bereavement support. - Medical Support: Free Online GP access, Health Cash Plan, Cancer Cover, and Menopause support. - Financial Support: Flexible pay with Wagestream, utility bill savings, Money Helper, and Life Assurance. - Physical Support: Online workouts, Cycle to Work scheme, gym discounts, and National Trust activities. Company Description Salutem Care and Education is dedicated to protecting and promoting the well-being of children, young adults, and vulnerable individuals. As part of our safer recruitment process, the successful candidate will be required to complete thorough pre-employment checks, including an enhanced DBS and, where applicable, overseas criminal record checks.

United Kingdom
£35K / year
Job Closed
Peraton Corporation logo

Information Assurance and Security Associate

Peraton Corporation

Peraton Corporation, a national security company headquartered in Herndon, Virginia, supplies solutions for mission-critical programs and systems. Founded in 2017, Peraton's missio

Role Description We are looking to add an Information Assurance and Security Associate to our team of talented professionals. In this role, you will: - Assist in maintaining the existing System Security Plan (SSP), internal testing against the SSP, support for DeCA sponsored Security Testing & Accreditation (ST&E); development of the plan of Actions & Milestones (POAMs) and assistance with any submission to the DeCA accrediting official for issuance of the Authority To Operate (ATO). - Assist with weekly reviews, documentation, and resolve all findings identified in vulnerability assessments and security compliance reviews, IAW DoDI 8531.01, DeCAM 35-31.01 and published USCYBERCOM directives for enterprise infrastructure. - Assist with ensuring audit logs meet the current audit requirements (Figure 1 of DeCAM 35-31.01). - Assist in maintaining audit logs and record findings per DeCAM 31-31.01. - Report anomalies identified during audit log reviews or alert notifications to the NCR IA Manager and/or DeCA's incident response team, as appropriate, and address identified anomalies and alert notifications per the guidance and reporting timelines defined by DeCAM 35-31.01 and DeCA Incident Response procedures. - Assist with enforcement of security policies and safeguards on all personnel having access to the information system for which NCR is responsible. Recommend the suspension of network access for users not complying with security policies of the system to the SISO/CISO. - Assist with developing procedures for and conduct periodic security reviews to enforce service account and DB password strengths. - Identify, analyze, and remediate applicable OS/DB STIG severity Category I, II or III finding (STIG Viewer) that occurs in systems or software IAW DeCAM 35-31.01. - Document and update deviations from STIGs or other hardening guides as new vulnerability issues are identified. - Assist with submitting evidence for security control and continuous monitoring compliance that impact ATO, vulnerability remediation activities, to include POA&Ms and security patching. Qualifications - 4 years with AS/AA; 2 years with BS/BA; 0 years with MS/MA or 6 years with High School diploma. - Must have an active CISSP certification. - Must have a Secret Clearance. - U.S. citizenship is required. - Must have the ability to assist with Cybersecurity personnel reviews regarding DEBOSS responsibilities and accounts twice per year IAW DeCAM 35-31.0. - Must have the ability to assist with conducting periodic benchmark scans to test products for STIG compliance and apply new STIGs IAW timelines and guidance in DeCAM 35-31.01. Benefits - Target Salary Range: $80,000 - $128,000. This represents the typical salary range for this position. - Salary is determined by various factors, including but not limited to, the scope and responsibilities of the position, the individual’s experience, education, knowledge, skills, and competencies, as well as geographic location and business and contract considerations. - Depending on the position, employees may be eligible for overtime, shift differential, and a discretionary bonus in addition to base pay. Company Description Peraton is a next-generation national security company that drives missions of consequence spanning the globe and extending to the farthest reaches of the galaxy. As the world’s leading mission capability integrator and transformative enterprise IT provider, we deliver trusted, highly differentiated solutions and technologies to protect our nation and allies. Peraton operates at the critical nexus between traditional and nontraditional threats across all domains: land, sea, space, air, and cyberspace. The company serves as a valued partner to essential government agencies and supports every branch of the U.S. armed forces. Each day, our employees do the can’t be done by solving the most daunting challenges facing our customers. Visit peraton.com to learn how we’re keeping people around the world safe and secure.

United States
$80K - $128K / year
Job Closed