Principal Security Engineer

Data Security Engineer

The Data Security Engineer is responsible for ensuring the confidentiality, integrity, and availability of enterprise data assets through the implementation of security controls, vulnerability management, and compliance activities. This role proactively identifies and mitigates cybersecurity risks, manages remediation efforts for identified vulnerabilities and CVEs, develops and tracks Plans of Action and Milestones (POA&Ms), and ensures adherence to organizational and regulatory security policies.

Key Responsibilities:

• Identify, assess, prioritize, and coordinate remediation of security vulnerabilities, including CVEs affecting infrastructure, applications, and data platforms.

• Develop, maintain, and track POA&Ms to document security findings, remediation plans, risk acceptance decisions, and closure activities.

• Monitor compliance with cybersecurity frameworks, security policies, and regulatory requirements.

• Conduct security assessments, vulnerability scans, and risk analyses to identify potential threats to data systems.

• Collaborate with engineering, operations, and development teams to implement security controls and corrective actions.

• Review system architectures and configurations to ensure data protection requirements are met.

• Support Authority to Operate (ATO), accreditation, and continuous monitoring activities.

• Investigate security incidents, document findings, and recommend corrective actions to prevent recurrence.

• Maintain security documentation, audit artifacts, and compliance evidence.

Required Skills:

• Experience with vulnerability management and remediation processes.

• Knowledge of CVE analysis, risk prioritization, and security hardening practices.

• Experience developing and managing POA&Ms.

• Familiarity with cybersecurity frameworks such as RMF, NIST 800-53, STIGs, and Zero Trust principles.

• Understanding of data protection, encryption, access controls, and secure system design.

• Strong written communication skills for documenting risks, findings, and compliance activities.

Preferred Experience:

• 5–8 years of cybersecurity, information assurance, or security engineering experience.
• 2–3 years supporting vulnerability management, RMF, ATO, POA&M, or compliance activities.
• Bachelor’s degree in Cybersecurity, Computer Science, Information Systems, Engineering, or related field (or equivalent experience).