Nist CSF 2.0 Jobs

This Director, Information Security Officer role leads cybersecurity strategy and operations for a key line of business within Capital One's Information Security Office. The position involves building and mentoring a team of security professionals to deliver product advisory services, manage cyber risks, and integrate security into modern cloud and data ecosystems. Key responsibilities include developing tailored security strategies, overseeing threat and vulnerability management, and advising executive leadership on risk-based initiatives. The role is appealing for its opportunity to drive innovation in a dynamic financial technology environment, work with cutting-edge technologies like Generative AI and Zero Trust, and foster a culture where security acts as a business enabler rather than a compliance hurdle.

The Director of Information Security leads the Information Technology Compliance Department within a banking institution, overseeing enterprise-wide cybersecurity, third-party vendor risk, and incident response strategies. Key responsibilities include managing regulatory compliance with frameworks like NIST CSF 2.0 and GLBA, developing and testing incident response playbooks, and directing artificial intelligence security policies. The role involves mentoring staff, presenting risk assessments to the Board of Directors, and maintaining relationships with external regulatory agencies. This position offers a dynamic environment for a seasoned leader to shape the bank's security posture while enjoying a hybrid work arrangement that balances office collaboration with remote flexibility.

This senior-level Cyber Security Analyst Tier III role supports the Virginia Information Technology Agency SOC team as the primary escalation authority for high-severity security incidents. The position involves leading complex investigations across identity, endpoint, and cloud environments, while building and maintaining advanced Splunk dashboards and automated detection workflows to enhance threat visibility. Key responsibilities include performing threat hunting, developing correlation searches using SPL and scripting languages like Python, and mentoring junior analysts on incident response best practices. The role is based on-site at GDIT's Integrated Technology Center in Bossier City, Louisiana. It appeals to candidates seeking a mission-driven environment with a culture of innovation, offering comprehensive benefits, a full-flex work week, and access to AI-powered career growth tools within a global technology organization.

The Operational Technology Security Engineer role supports a government contractor team delivering strategic IT services to Defense and Federal customers. The position focuses on securing industrial environments by integrating OT processes with information systems, managing vulnerabilities, and implementing risk mitigation strategies. Key responsibilities include analyzing security requirements across the system lifecycle, configuring secure network architectures, and developing incident response plans for SCADA and ICS systems. This opportunity appeals to professionals seeking to apply specialized OT cybersecurity expertise in a mission-critical setting. The role requires a Secret clearance and offers a dynamic environment for those who thrive on solving complex security challenges with minimal supervision.

The Security Engineer (DLP) role is based in the Columbus office within Benesch's cybersecurity team, focusing on protecting sensitive data and enhancing the firm's security posture. Key responsibilities include deploying and tuning Data Loss Prevention and Cloud Access Security Broker solutions, managing endpoint detection and response initiatives, and leading incident response efforts using SIEM platforms. The position also involves supporting secure cloud architecture across major providers and ensuring compliance with industry frameworks. This opportunity appeals to candidates seeking a hybrid work arrangement with flexibility, offering a collaborative environment recognized as a top workplace. The role provides significant growth potential within a rapidly expanding firm that values diversity, transparent leadership, and professional development.

The Principal Enterprise Security Architect - Director role serves as a global strategic authority within SMBC Group's Americas division, responsible for shaping the Enterprise Security Architecture strategy for a top-tier financial institution. Key duties include defining multi-year security roadmaps that integrate cloud resilience, zero trust principles, and emerging AI/agentic system safeguards while ensuring alignment with global regulatory frameworks. The position involves advising C-suite leaders, governing enterprise-wide security standards, and mentoring future architects to drive innovation. This opportunity appeals to candidates seeking to lead high-impact security initiatives in a collaborative, hybrid work environment with a prestigious global organization known for its 400-year history and commitment to future-proofing financial services.

The Information Systems Security Officer role within Space Dynamics Laboratory's C4ISR Division supports mission-critical defense and intelligence programs. The position focuses on ensuring system compliance with NIST 800-53 and RMF frameworks while managing the Authorization to Operate process. Key responsibilities include developing security documentation, conducting vulnerability assessments, and coordinating remediation efforts with technical teams. This opportunity appeals to professionals seeking to contribute to national security through innovative satellite and sensor technologies. The role offers a collaborative culture that values empowerment and accountability, with a work arrangement that supports a fast-paced, team-oriented environment.

This Principal Product Security Engineer role supports the newly formed Product Security team within Johnson & Johnson's medical device division, focusing on integrating security by design into the product lifecycle. The position requires collaboration with engineering groups to establish and refine security processes, serve as a subject matter expert on cyber risks, and manage pre-market and post-market compliance activities including threat modeling and vulnerability management. The role appeals to candidates seeking to directly impact patient safety while working in a collaborative, patient-first culture. The position is based in Danvers, Massachusetts or Raritan, New Jersey, with a hybrid work arrangement requiring office presence at least three days per week.

The Security Assessor role at TLA focuses on evaluating the effectiveness of security controls within information systems to ensure data protection and regulatory compliance. Key responsibilities include conducting comprehensive security assessments, identifying vulnerabilities through scanning and testing, and collaborating with IT teams to validate remediation strategies. The position requires preparing detailed documentation and ensuring adherence to frameworks such as NIST and ISO 27001. This opportunity is appealing for professionals passionate about national security missions, offering a collaborative culture that values innovation and excellence. The company supports career growth through education reimbursement, certification opportunities, and professional development. The role is based on-site with a focus on delivering impactful outcomes for government customers.

This Principal Product Security Engineer role supports the newly formed Product Security team within Johnson & Johnson's medical device division. The position focuses on embedding security by design throughout the product lifecycle, from pre-market development to post-market vulnerability management. Key responsibilities include partnering with engineering teams to enforce security policies, creating and improving security processes, and generating critical documentation such as threat models and risk management plans. The role also involves guiding compliance certification activities and advising on balancing business needs with medical device security objectives. This opportunity appeals to candidates seeking to directly impact patient lives within a Patient First culture. The position is based in Danvers, MA or Raritan, NJ, with a hybrid work arrangement requiring office presence at least three days per week.

This Principal Product Security Engineer role supports the newly formed Product Security team within Johnson & Johnson's medical device division. The position focuses on embedding security by design throughout the product lifecycle, from pre-market development to post-market vulnerability management. Key responsibilities include partnering with engineering teams to enforce security policies, creating and improving security processes, and delivering critical documentation such as threat models and risk management plans for regulatory compliance. The role appeals to candidates seeking to directly impact patient lives by shaping industry standards in a collaborative, patient-first culture. While the position is primarily based in Danvers, MA or Raritan, NJ with a requirement to be in-office at least three days per week, remote work options may be considered on a case-by-case basis.

This Principal Product Security Engineer role supports the newly formed Product Security team within Johnson & Johnson's medical device division. The position focuses on embedding security by design throughout the product lifecycle, from pre-market development to post-market vulnerability management. Key responsibilities include partnering with engineering teams to enforce security policies, creating and improving security processes, and delivering critical documentation such as threat models and risk management plans. The role also involves guiding compliance certification activities and advising development teams on balancing business needs with medical device security objectives. This opportunity appeals to candidates seeking to directly impact patient lives within a collaborative, patient-first culture. The position is based in Danvers, MA or Raritan, NJ, with a hybrid work arrangement requiring office presence at least three days per week.

This Principal Product Security Engineer role supports the newly formed Product Security team within Johnson & Johnson's medical device division. The position focuses on embedding security by design throughout the product lifecycle, from pre-market development to post-market vulnerability management. Key responsibilities include partnering with engineering teams to enforce security policies, creating and improving security processes, and delivering critical documentation such as threat models and risk management plans. The role appeals to candidates seeking to directly impact patient lives by shaping industry standards and ensuring compliance with rigorous regulatory frameworks like FDA, ISO 27001, and SOC2. The position is based in Danvers, MA, or Raritan, NJ, with a hybrid work arrangement requiring office presence three days per week, offering a collaborative environment within a Patient First culture.

This Principal Product Security Engineer role supports the newly formed Product Security team within Johnson & Johnson's medical device division, focusing on integrating security by design into the product lifecycle. The position requires partnering with engineering groups to enforce security policies, develop risk management documentation, and guide teams through pre-market and post-market compliance activities. Key responsibilities include creating security processes, acting as a subject matter expert on cyber threats, and supporting certifications such as SOC2 and ISO 27001. The role is based in Danvers, MA, with a hybrid schedule requiring three days in the office, though remote options may be considered. The position appeals to candidates seeking to impact patient safety directly within a collaborative, patient-first culture while shaping industry standards for medical device security.

This Principal Product Security Engineer role is part of the Technology Enterprise Strategy & Security team within Johnson & Johnson's medical device division. The position focuses on embedding security by design into the product development lifecycle, partnering with engineering groups to ensure adherence to security policies and regulatory standards. Key responsibilities include creating and improving security processes, acting as a subject matter expert on cyber security matters, and delivering critical documentation for pre-market activities and compliance certifications such as SOC2 and ISO 27001. The role appeals to candidates seeking to directly impact patient lives through innovative security solutions in a regulated environment. The position is based in Danvers, MA, with a hybrid work arrangement requiring office presence three days per week, though remote options may be considered on a case-by-case basis.

This Principal Product Security Engineer role supports the newly formed Product Security team within Johnson & Johnson's medical device division. The position focuses on embedding security by design throughout the product lifecycle, from pre-market development to post-market vulnerability management. Key responsibilities include partnering with engineering teams to enforce security policies, creating and improving security processes, and delivering critical documentation such as threat models and risk management plans. The role also involves guiding compliance certification activities and advising development teams on balancing business needs with medical device security objectives. This opportunity appeals to candidates seeking to directly impact patient lives within a Patient First culture. The position is based in Danvers, MA, with a hybrid work arrangement requiring office presence three days per week, though remote options may be considered case-by-case.

This Principal Product Security Engineer role resides within the Technology Enterprise Strategy & Security team at Johnson & Johnson, focusing on securing medical device products. The position involves partnering with engineering groups to embed security by design throughout the product lifecycle, from pre-market development to post-market vulnerability management. Key responsibilities include creating and refining security processes, acting as a subject matter expert on cyber threats, and delivering critical documentation for regulatory compliance such as SOC2 and ISO 27001. The opportunity is appealing for its chance to directly impact patient safety while shaping industry standards in a Patient First culture. The role is based in Danvers, MA or Raritan, NJ, with a hybrid work arrangement requiring office presence three days per week.

This Principal Product Security Engineer role supports the newly formed Product Security team within Johnson & Johnson's medical device division. The position focuses on embedding security by design throughout the product lifecycle, from pre-market development to post-market vulnerability management. Key responsibilities include partnering with engineering teams to enforce security policies, creating and improving security processes, and delivering critical documentation such as threat models and risk management plans. The role appeals to candidates seeking to directly impact patient lives by shaping industry standards and ensuring compliance with rigorous frameworks like ISO 27001 and FDA regulations. The position is based in Danvers, MA or Raritan, NJ, with a hybrid work arrangement requiring office presence three days per week, offering a collaborative environment within a Patient First culture.

This full-time Information System Security Engineer role supports the Crane Naval Base in Indiana within a government-focused technology team. The position involves designing and implementing secure network architectures, managing Risk Management Framework activities, and developing technical security documentation such as risk assessments and cybersecurity strategies. The role requires independent execution of certification and testing processes in compliance with NIST and DoD standards. The position is appealing due to the company's strong investment in employee growth through training, certification support, and tuition assistance. It offers a collaborative small-company culture with Monday through Friday day shifts, paid relocation assistance, and comprehensive benefits including healthcare and retirement plans.

The Associate Director, Research Security role at the University of Pennsylvania leads the institution's program for managing federal research data security compliance within a complex academic environment. Key responsibilities include developing risk-based security policies, ensuring adherence to standards such as CMMC and NIST SP 800-171, and coordinating institution-wide initiatives to protect sensitive research data. The position involves auditing system inventories, managing incident response, and serving as a subject matter expert for contract negotiators and research teams. This opportunity appeals to professionals seeking to work at a world-renowned Ivy League university with a collaborative culture, offering access to extensive professional development, comprehensive benefits, and a dynamic urban campus in Philadelphia.

The Cybersecurity Manager leads the organization's security strategy and program management within the energy sector. Key responsibilities include developing enterprise-wide policies, ensuring compliance with NERC CIP, ISO 27001, and SOC2 standards, and managing risk assessments and incident response plans. The role involves reviewing customer contracts for security obligations and collaborating with cross-functional teams to align security initiatives with business goals. This position offers the opportunity to drive continuous improvement in cybersecurity posture while working with a global team across different time zones. The role supports a mission-critical environment focused on critical infrastructure protection and renewable energy, appealing to candidates seeking to apply advanced expertise in a dynamic, high-impact setting with up to 10% travel.

This full-time Cyber Security Engineer role supports mission-critical national security and defense programs within the Technology and Consulting Services team at Maximus. The position requires an active TS/SCI clearance and is based onsite five days a week in San Antonio, Texas. Key responsibilities include implementing cybersecurity controls for JCC2 systems, conducting risk assessments and vulnerability scans, responding to security incidents, and ensuring compliance with DoD policies and RMF standards. The role appeals to professionals seeking high-impact work in a fast-paced environment where they can contribute to meaningful government missions. Candidates will collaborate with engineering teams to improve system security posture and participate in Agile planning activities. The position offers the opportunity to work with advanced security technologies and supports career growth through exposure to classified systems and DoD DevSecOps environments.

The Cyber Security Analyst II role supports the Naval Information Warfare Center in Oahu, Hawaii, focusing on the FORGE additive manufacturing facility at Schofield Barracks. Key responsibilities include developing Risk Management Framework packages, maintaining Authorization and Accreditation documentation, and implementing security controls aligned with NIST standards. The position involves assessing vulnerabilities using tools like ACAS and Nessus, managing POA&Ms, and creating system authorization boundary diagrams. This opportunity appeals to professionals seeking to work within a high-impact Department of War Joint environment while collaborating with diverse internal and external stakeholders. The role requires an active Secret security clearance and offers a chance to contribute to critical national security infrastructure.

This full-time Cyber Security Engineer role supports mission-critical national security and defense programs for Maximus in San Antonio, Texas. The position requires an active TS/SCI clearance and involves implementing cybersecurity controls, conducting risk assessments, and responding to security incidents within DoD environments. Key responsibilities include performing vulnerability scans, ensuring compliance with RMF and NIST standards, and collaborating with engineering teams to maintain system security. The role appeals to professionals seeking high-impact work in a fast-paced government setting with a focus on accountability and results. Candidates must be available to work onsite five days a week and possess five years of experience with DoD frameworks and security technologies.

The Information Systems Security Officer role serves as a dual technical architect and compliance steward within the OIM department, bridging cybersecurity architecture with federal governance. Key responsibilities include designing secure-by-design systems, managing the Assessment and Authorization process, and overseeing continuous monitoring of security controls across diverse information systems. The position requires leading risk assessments, maintaining Plans of Action and Milestones, and ensuring strict adherence to NIST and DOE federal mandates. This opportunity appeals to professionals seeking to shape enterprise security strategy while working in a collaborative environment that values resilience and mission-critical protection. The role involves close collaboration with cross-functional teams and offers the chance to influence security culture through training and policy development.