Why Castelion, Why Now

Castelion is moving incredibly fast to develop and deliver advanced defense systems at a time when execution matters more than ever. We believe focus, ownership, and excellence are decisive advantages - and we're building a world-class team to turn bold ideas into real capability.

This is a rare opportunity to join at an early stage, where you'll have significant ownership, collaborate with exceptional teammates, and make a direct, measurable impact on our mission and the future of the company - regardless of your function.

Information System Security Engineer

The Information System Security Engineer (ISSE) at Castelion is responsible for translating security requirements into tested controls for classified information systems. In this role, you will harden systems and networks, configure security tools, investigate findings, and work with Information System Security Managers (ISSMs), Information System Security Officers (ISSOs), and IT engineers to support system authorization and continued operation. This position offers the opportunity to build practical security capabilities for disconnected engineering environments that support product development and testing.

Responsibilities

Harden Windows, Red Hat Enterprise Linux (RHEL), virtualization platforms, and network infrastructure. Apply Defense Information Systems Agency Security Technical Implementation Guides (DISA STIGs), implement approved access and network-segmentation controls, and test changes with IT engineers to preserve required services.
Configure and maintain security information and event management (SIEM), endpoint protection, and centralized logging. Integrate log sources, tune alerts, verify agent and data-collection health, and support investigation, containment, and recovery when security events occur.
Assess vulnerabilities and security configurations, prioritize findings with system owners, implement approved fixes, and verify results. Document remaining risks and maintain security tools, patches, and update content through approved offline processes.
Work with the ISSM and ISSO on Risk Management Framework (RMF) activities to obtain and maintain an Authorization to Operate (ATO). Provide configuration records, scan results, system diagrams, control-implementation evidence, and remediation updates for assessments and Plans of Action and Milestones (POA&Ms).
Review internally developed software, third-party packages, and container images with developers before introduction into classified systems. Support controlled testing and release, automate repeatable security checks, and maintain operating procedures and change records.

Basic Qualifications

Hands-on experience supporting classified information systems, including work within approved security boundaries and controlled change processes.
Experience securing Windows and Linux servers or workstations, including authentication, permissions, auditing, and services; working knowledge of Active Directory and Group Policy.
Experience hardening networks through segmentation, firewall or access-control rules, secure management interfaces, and restriction of unnecessary ports, protocols, and services.
Practical experience applying DISA STIGs, assessing configurations through automated and manual checks, documenting findings, and verifying corrective actions.
Experience configuring or maintaining a SIEM, including log collection, searches, alert tuning, and investigation.
Experience deploying or administering endpoint protection, including policy configuration, agent health, update management, approved exclusions, and troubleshooting.
Experience using vulnerability-assessment tools to identify findings, evaluate operational impact, and confirm remediation.
Experience supporting ISSM/ISSO authorization activities, security-control evidence, assessment preparation, and finding closure under the RMF.
Ability to troubleshoot security configurations, document work clearly, and explain technical risks and proposed fixes to security and IT teams.