ShorePoint Inc.

Compliance and Continuous Monitoring Engineer - Vulnerability Management (Top Secret Clearance)

ShorePoint Inc. • $100K — $130K *
Washington, DC 20011In-Person
Information Technology
Less than 5 years of experience
2 months ago
Job Overview by Ladders

Qualifications

  • Bachelor's degree in Cybersecurity, Computer Science, Information Systems, Mathematics, Engineering, or equivalent IT experience (10+ years).
  • One or more certifications: CISSP, GIAC, GCIA, or GCIH.
  • Proficient in enterprise-class scanning tools like Tenable Nessus and Tenable Security Center.
  • Experience performing assessments of networks, databases, and web applications.
  • Strong understanding of federal frameworks like NIST 800-53 and 800-53A.
  • Excellent communication skills for articulating findings clearly.

Responsibilities

  • Conduct site visits to ensure understanding of security controls.
  • Perform compliance assessments using tailored control matrices.
  • Establish footholds on endpoints for visibility into security posture.
  • Use automation tools to review system configurations and compliance.
  • Conduct NIST control assessments for system authorization.
  • Maintain Security Assessment Reports (SARs) and Risk Assessment Reports (RARs).
  • Execute weekly to bi-weekly vulnerability scans and report findings.

Benefits

  • Opportunity to shape growth and culture in a fast-growing cybersecurity company.
  • Hands-on involvement in strengthening enterprise cybersecurity posture.
  • Work in a role that requires a Top Secret Clearance, enhancing career visibility.
  • Engagement with diverse security assessments and compliance strategies.
Full Job Description
Who we're looking for:

We are seeking Compliance and Continuous Monitoring Engineer - Vulnerability Management (Top Secret Clearance) with expertise in security assessments, vulnerability management and continuous monitoring. The ideal candidate will support assessment and authorization activities, conduct technical security evaluations and ensure enterprise systems remain compliant with federal cybersecurity standards. The Compliance and Continuous Monitoring Engineer (Vulnerability Management) role will provide hands-on scanning, reporting and compliance support to strengthen the enterprise cybersecurity posture. This is a unique opportunity to shape the growth, development and culture of an exciting and fast-growing company in the cybersecurity market.

What you'll be doing:

  • Work closely with organizations to ensure full comprehension of security controls; conduct site visits as required.
  • Assist with compliance assessments using tailored control matrices; provide expert assessment support.
  • Conduct annual reviews of security controls to ensure continued compliance.
  • Establish footholds on endpoints to provide day-to-day visibility into enterprise security posture.
  • Develop and maintain processes and best practices for evaluating assessment and authorization data.
  • Use industry-standard automation tools to review system configurations and security control compliance.
  • Conduct NIST control assessments in support of system authorization and continuous monitoring.
  • Develop and maintain Security Assessment Reports (SARs) and Risk Assessment Reports (RARs).
  • Employ a scan-patch-scan methodology to ensure proper remediation of vulnerabilities.
  • Conduct vulnerability scanning on a weekly to bi-weekly basis using industry-standard tools.
  • Report scan data to system administrators to support timely remediation.
  • Perform false positive and vulnerability analysis to validate findings and prioritize remediation.
  • Configure applications to ingest, process and report vulnerability data from assessments and self-assessments.
  • Conduct long-term trend analysis to identify changes in enterprise security posture.
  • Provide dashboard views and executive-level reports to communicate risk, vulnerability and compliance posture.
  • Configure authenticated and unauthenticated scans of web servers (e.g., Apache, IIS) to identify vulnerabilities such as outdated software, misconfigurations, exposed services and SSL/TLS weaknesses.
  • Assess both in-house and COTS web applications to identify OWASP Top 10 risks, including SQL injection, cross-site scripting (XSS) and insecure HTTP headers.
  • Lead technical troubleshooting sessions with administrators and leadership to analyze findings, validate issues and drive remediation efforts.
  • Maintain a general understanding of network architecture diagrams to support vulnerability analysis and remediation planning.


What you need to know:

  • Strong understanding of federal frameworks including NIST 800-53 and 800-53A.
  • Knowledge of SANS and OWASP Top 10 vulnerabilities and best practices.
  • Ability to synthesize and analyze large volumes of vulnerability and scan data.
  • Ability to clearly articulate findings in written and verbal form.


Must have's:

  • Bachelor's degree in Cybersecurity, Computer Science, Information Systems, Mathematics, Engineering or a related field or additional 10+ years of IT experience in lieu of degree.
  • One or more of the following certifications: (ISC)2 Certified Information Security Professional (CISSP), GIAC, GCIA or GCIH
  • Proven ability to analyze complex requirements and translate them into clear, actionable tasks and processes through critical thinking.
  • Ability to perform vulnerability and compliance assessments on all devices identified during enterprise network scans, including operating systems oracle and MySQL databases and web applications.
  • Proficiency with enterprise-class scanning tools such as Tenable Nessus and Tenable Security Center, database scanning tools such as AppDetective and DbProtect and web scanning tools such as Web Inspect, with strong knowledge of security best practices and common vulnerabilities for each technology, including SANS and OWASP Top 10.
  • Experience performing enterprise-level assessment scanning of networks, databases and web applications.
  • Ability to configure and perform host, port and service discoveries on large enterprise networks and identify target operating systems and applications or services from discovery results.
  • Proficiency in configuring, troubleshooting and administering Tenable Security Center, Tenable Nessus standalone, AppDetective and Web Inspect.
  • Strong understanding of security policies used by intelligence organizations, as well as NIST guidelines (e.g., 800-53 and 800-53A).
  • Ability to think critically and creatively and to synthesize and analyze large volumes of scan data.
  • Strong written and verbal communication skills with the ability to present findings clearly and comprehensively.
  • Applicants must possess an Top-Secret clearance with SCI eligibility and ability to pass a Counterintelligence (CI) polygraph.


Beneficial to have:

  • Experience with open-source and commercial testing tools, including Nessus, NMAP, AppDetective, Hailstorm, Guardium and Web Inspect.


Where it's done:

  • Onsite (Washington, DC.)

About ShorePoint Inc.

ShorePoint Inc. is a cybersecurity and IT consulting firm that provides services to the federal government and commercial clients. The company's services include cybersecurity, cloud computing, data analytics, and software development. ShorePoint was founded in 2015 and is headquartered in Reston, Virginia. The company has additional offices in Washington, D.C. and Colorado Springs, Colorado.
Learn more about ShorePoint Inc.
Size
300 employees
Industry
Information Technology
Founded
2015
* Ladders Estimates

Similar Jobs

Ad banner background

Get Ready For Your
Next Interview

More Jobs at ShorePoint Inc.

More Information Technology Jobs

Find similar Compliance and Continuous Monitoring Engineer - Vulnerability Management (Top Secret Clearance) jobs:

NationwideWashington, DC