Senior Information Systems Security Officer, NGC2
Anduril Industries · Costa Mesa, California, United States
About this role
## Anduril Industries — Senior Information Systems Security Officer (NGC2) ### About the Team The Connected Warfare division builds systems to support global command and control missions—creating joint, time-sensitive, multi-domain, ubiquitous, connected mesh ecosystems. The ecosystem connects robots, humans, and sensors across domains to provide the source of truth for time-sensitive decisions and mission autonomy. ### About the Job As the ISSO for a large-scale Army Command & Control (C2) program, you’ll be a hands-on security practitioner responsible for day-to-day compliance execution and vulnerability management across a cloud-native platform. You’ll work under the ISSM to manage CVE remediation workflows, review third-party vendor security artifacts, maintain authorization documentation in eMASS, and enforce continuous monitoring across multiple environments running on a Kubernetes-based PaaS. ### What You’ll Do - Track and coordinate CVE remediation across all program environments using automated container vulnerability scanning; enforce SLA timelines with engineering teams - Review third-party vendor onboarding security packages (container scan results, SAST reports, CSSP audit logging documents, POA&Ms, SBOMs, STIG checklists, and network/data flow diagrams) - Validate STIG compliance using SCAP and Evaluate-STIG; review against DISA STIGs for containerized applications and Kubernetes infrastructure - Manage and audit user access controls via the platform’s role-based permission model; enforce least privilege and RBAC across all environments - Monitor security events in coordination with the program’s CSSP (24/7 monitoring); review audit logs, investigate anomalies, and escalate per incident response procedures - Maintain security artifacts in eMASS (POA&Ms, risk assessments, authorization letters, and continuous monitoring evidence across multiple eMASS records) - Review platform Change Requests for security impact - Support RMF activities including security control assessments, SCA evidence collection, and ATO package preparation - Conduct weekly CVE expiry reviews; compile per-team remediation lists and coordinate bulk outreach to engineering teams - Assist with ISA development and review for system interconnections and Cross-Domain Solution paths ### Required Qualifications - 5+ years of experience in cybersecurity or information assurance with hands-on compliance execution in a DoD environment - DoD 8570/8140 compliance at IAT Level II or higher (e.g., Security+, CySA+, or CCNA Security) - Working knowledge of NIST 800-53 security controls, DISA STIGs, and RMF processes - Experience with vulnerability scanning tools and CVE remediation tracking workflows - Experience managing user access controls and conducting account/access reviews - Active U.S. Secret security clearance (and ability to maintain it) ### Preferred Qualifications - Experience with container security scanning (Trivy, Grype, or similar) in Kubernetes environments - Familiarity with cloud PaaS platforms in a DoD context (IL2 through IL6) - Experience with eMASS for RMF package management and continuous monitoring - Hands-on experience reviewing third-party vendor security artifacts (SBOMs, SAST/DAST reports, POA&Ms) for onboarding decisions - Familiarity with Cross-Domain Solutions and multi-enclave environments - CompTIA CySA+, CEH, or GIAC certifications ### Salary Range $147,000 — $196,000 USD (base salary estimate; equity and benefits may be include
Listing freshness
CronJobs last confirmed this listing 1h ago. If its source stops confirming the opening for seven days, this page is removed from active inventory.