CDIT Solutions is
seeking a Cyber Test Engineer to support the Joint Transportation Management
System (JTMS) program for the United States Transportation Command
(USTRANSCOM). This automation engineer supports ISSO/ISSE security compliance,
testing, and continuous-monitoring automation for an IL5 multi-cloud
environment.
STIG / SCAP
Automation
• Automate continuous DISA SCAP benchmark scanning
using ACAS (Tenable SC) and Nessus.
• Use SCAP Compliance Checker (SCC) to validate
XCCDF, ARF, and CKL results.
• Automate Trellix Policy Auditor STIG compliance
scanning.
Testing &
Quality
• Perform test automation with Tricentis,
including SAP and Mendix regression testing.
• Implement SonarQube quality gates and integrate
them into CI/CD pipelines.
• Support Fortify SAST scanning and software bill
of materials (SBOM) generation (CycloneDX / SPDX).
CI/CD Pipeline
• Develop GitLab CI/CD pipelines and implement
security gates.
• Perform IaC testing (Terraform / CloudFormation
validation).
• Integrate security-scanning results into AWS
Security Hub.
SIEM / SOAR
• Develop Splunk ES queries and alert automation.
• Develop Splunk SOAR playbooks, targeting
automated response times of 30–90 seconds.
• Apply ESCU (Enterprise Security Content Updates)
detection rules.
Compliance
Automation
• Integrate with the eMASS API for automated
evidence upload.
• Develop AWS Config conformance packs for
continuous compliance.
• Automate controls with AWS Audit Manager.
• Automate CORA evidence pipelines.
• Support ISSO/ISSE teams with security
compliance, testing, and continuous monitoring.
• Interim Secret clearance (minimum). Clearance
must be active, in scope, and held in DISS prior to start.
• 4+ years of experience in security automation,
compliance testing, or DevSecOps.
• DoD 8140 certification at the Foundational
Intermediate level for 671 System Testing & Evaluation Specialist
(tentative): one of CEH, CFR (CyberSec First Responder), Cloud+, GSEC,
PenTest+, Security+, or SSCP.
• Experience with ACAS (Tenable SC) and Nessus
automation for continuous DISA SCAP benchmark scanning.
• Knowledge of SCAP Compliance Checker (SCC) for
XCCDF / ARF / CKL validation.
• Experience automating Trellix Policy Auditor
STIG compliance scanning.
• Proficiency with Tricentis test automation (SAP
and Mendix regression testing).
• Experience with SonarQube quality gates and
CI/CD pipeline integration.
• Familiarity with Fortify SAST and SBOM
generation (CycloneDX / SPDX).
• GitLab CI/CD pipeline development and
security-gate implementation.
• IaC testing (Terraform / CloudFormation
validation) and integration of security-scanning results into AWS Security Hub.
• Splunk ES query development and alert
automation; Splunk SOAR playbook development; experience with ESCU detection
rules.
• eMASS API integration for automated evidence
upload; AWS Config conformance-pack development; AWS Audit Manager control
automation; CORA evidence-pipeline automation.
• Python, PowerShell, or Bash scripting.
• AWS GovCloud experience (Lambda, EventBridge,
Step Functions).
• Understanding of RMF continuous-monitoring
requirements.
• Experience with SAFe Agile methodology and PI
planning.
• Remote, with approximately 10% travel every 12
weeks to Scott Air Force Base, IL. Candidates within a 4-hour radius of Scott
AFB are preferred.
• DoD 8140 compliance is required, as described in
the certification requirement above.
Skills Required
- Active, in-scope Interim Secret clearance held in DISS before start
- At least 4 years of experience in security automation, compliance testing, or DevSecOps
- DoD 8140 Foundational Intermediate certification for 671 System Testing and Evaluation Specialist, including one of CEH, CFR, Cloud+, GSEC, PenTest+, Security+, or SSCP
- Experience with ACAS/Tenable SecurityCenter and Nessus automation for continuous DISA SCAP benchmark scanning
- Knowledge of SCAP Compliance Checker for XCCDF, ARF, and CKL validation
- Experience automating Trellix Policy Auditor STIG compliance scanning
- Proficiency with Tricentis test automation, including SAP and Mendix regression testing
- Experience with SonarQube quality gates and CI/CD pipeline integration
- Familiarity with Fortify SAST and SBOM generation using CycloneDX or SPDX
- GitLab CI/CD pipeline development and security-gate implementation experience
- Experience with IaC testing using Terraform or CloudFormation and integrating security results into AWS Security Hub
- Splunk Enterprise Security query development, alert automation, Splunk SOAR playbook development, and ESCU detection-rule experience
- Experience integrating with the eMASS API and automating AWS Config conformance packs, AWS Audit Manager controls, and CORA evidence pipelines
- Python, PowerShell, or Bash scripting
- AWS GovCloud experience with Lambda, EventBridge, or Step Functions
- Understanding of RMF continuous-monitoring requirements
- Experience with SAFe Agile methodology and PI planning
What We Do
CDIT, headquartered in Slidell, LA, has provided technical services for both commercial and Federal customers for the past 18 years. We deliver high-value services with our Agile integrated approach, consisting of Lean-Agile frameworks, process maturity, best practices combined with information security and quality management standards. This integrated approach is paired with the principles of accountability, collaboration, and delivery established our core CDIT execution model. This model allows us to successfully deliver and perform on small to large-scale programs remotely and on-site. CMMI III DEV | ISO 9001:2015 | ISO 27001:2015
