Information System Security EngineerThe Information System Security Engineer (ISSE) at Castelion is responsible for translating security requirements into tested controls for classified information systems. In this role, you will harden systems and networks, configure security tools, investigate findings, and work with Information System Security Managers (ISSMs), Information System Security Officers (ISSOs), and IT engineers to support system authorization and continued operation. This position offers the opportunity to build practical security capabilities for disconnected engineering environments that support product development and testing.
Responsibilities- Harden Windows, Red Hat Enterprise Linux (RHEL), virtualization platforms, and network infrastructure. Apply Defense Information Systems Agency Security Technical Implementation Guides (DISA STIGs), implement approved access and network-segmentation controls, and test changes with IT engineers to preserve required services.
- Configure and maintain security information and event management (SIEM), endpoint protection, and centralized logging. Integrate log sources, tune alerts, verify agent and data-collection health, and support investigation, containment, and recovery when security events occur.
- Assess vulnerabilities and security configurations, prioritize findings with system owners, implement approved fixes, and verify results. Document remaining risks and maintain security tools, patches, and update content through approved offline processes.
- Work with the ISSM and ISSO on Risk Management Framework (RMF) activities to obtain and maintain an Authorization to Operate (ATO). Provide configuration records, scan results, system diagrams, control-implementation evidence, and remediation updates for assessments and Plans of Action and Milestones (POA&Ms).
- Review internally developed software, third-party packages, and container images with developers before introduction into classified systems. Support controlled testing and release, automate repeatable security checks, and maintain operating procedures and change records.
Basic Qualifications- Hands-on experience supporting classified information systems, including work within approved security boundaries and controlled change processes.
- Experience securing Windows and Linux servers or workstations, including authentication, permissions, auditing, and services; working knowledge of Active Directory and Group Policy.
- Experience hardening networks through segmentation, firewall or access-control rules, secure management interfaces, and restriction of unnecessary ports, protocols, and services.
- Practical experience applying DISA STIGs, assessing configurations through automated and manual checks, documenting findings, and verifying corrective actions.
- Experience configuring or maintaining a SIEM, including log collection, searches, alert tuning, and investigation.
- Experience deploying or administering endpoint protection, including policy configuration, agent health, update management, approved exclusions, and troubleshooting.
- Experience using vulnerability-assessment tools to identify findings, evaluate operational impact, and confirm remediation.
- Experience supporting ISSM/ISSO authorization activities, security-control evidence, assessment preparation, and finding closure under the RMF.
- Ability to troubleshoot security configurations, document work clearly, and explain technical risks and proposed fixes to security and IT teams.
- Experience performing privileged administration on secure or classified systems, including administrative account management, access controls, audit logging, and documented configuration changes.
- Must possess and maintain a current cybersecurity certification accepted for the position's assigned DoD Cyber Workforce Framework (DCWF) work role and proficiency level, and meet applicable DoD 8140.03 and program qualification requirements.
Preferred Skills and Experience- Experience maintaining air-gapped systems, including approved media transfers, offline patches, security-content updates, and local software repositories.
- Experience with Splunk or Elastic Security, including Linux rsyslog, Windows event forwarding, or similar log collection methods.
- Experience with Trellix endpoint protection, ePolicy Orchestrator (ePO), or data loss prevention (DLP); Nessus/Tenable; or Security Content Automation Protocol (SCAP) assessment tools and STIG Viewer. Equivalent tool experience is relevant.
- Experience securing VMware vSphere/ESXi or Microsoft Hyper-V, storage and backup services, and Juniper or comparable network infrastructure.
- Experience with PowerShell, Bash, Python, or Ansible to automate configuration checks, evidence collection, or approved remediation.
- Experience with eMASS or comparable authorization-documentation tools, initial system authorization, and applicable NIST security controls, Defense Counterintelligence and Security Agency (DCSA) requirements, or the Joint Special Access Program Implementation Guide (JSIG).
- Experience reviewing software dependencies, container images, and software bills of materials (component inventories), using tools such as Trivy, Anchore, or equivalent. Familiarity with approved on-premises source-control and build/release workflows, such as GitHub Enterprise Server.
Additional Requirements- Ability to put in extended hours, including evenings and weekends, when required to meet aggressive timelines.
- This role is based in Torrance, CA and requires full-time onsite presence.
- Occasional travel is required.
Physical Demands- Ability to lift and move equipment weighing at least 40 pounds when supporting equipment installation or maintenance, with or without reasonable accommodation.
Other DutiesPlease note this job description is not designed to cover or contain a comprehensive listing of activities, duties or responsibilities that are required of the employee for this job. Duties, responsibilities and activities may change at any time with or without notice.
Benefits and PerksAll full-time employees are granted meaningful long-term equity, sharing in the company's significant growth trajectory. We offer four (4) weeks of paid time off, ten (10) company-paid holidays, and comprehensive health benefits - including 100% employee-covered medical and strong dependent coverage, along with dental and vision plans. We also provide paid parental leave to support growing families, a $100 monthly fitness stipend to promote health and performance, and onsite EV charging for convenience. In addition, employees enjoy perks like catered meals, company-covered food during high-demand periods, and a fully stocked kitchen to stay fueled throughout the day.
Security Clearance and AccessU.S. citizenship is required. Must possess and maintain an active Top Secret/Sensitive Compartmented Information (TS/SCI) security clearance and meet applicable program-access requirements. This position requires privileged access to classified systems. Required privileged-user training and system-specific authorizations must be completed before performing privileged duties.
