About this role
Responsibilties
- Responsible for integrating security engineering principles, requirements, and controls into the design, development, testing, and sustainment of information systems throughout the Systems Development Life Cycle (SDLC).
- This role serves as the primary security engineering authority supporting system owners, ISSOs, and development teams in achieving and maintaining a system’s Authorization to Operate (ATO).
- Identifies and documents information security requirements during system design and participates in design reviews, recommending engineering solutions to mitigate identified risks.
- Supports the categorization, selection, implementation, and assessment of security controls under NIST SP 800-53/RMF, developing SSPs, SARs, and POA&Ms in support of ATO packages.
- Engineers and validates technical security controls (access control, auditing, encryption, boundary protection) and conducts or supports security testing to verify control effectiveness.
- Reviews system configurations against DISA STIGs, supports vulnerability management and remediation prioritization, and assesses the security impact of proposed system changes.
- Prepares technical security documentation (architecture diagrams, control implementation statements, interconnection security agreements) and advises ISSOs, program managers, and developers throughout the system lifecycle.
Qualifications
- Bachelor’s degree in Cybersecurity, Information Technology, Computer Science, or a related field, ideally with 8 years’ experience.
- Proven experience working in a Federal environment using SDLC to integrate security engineering principles, requirements, and controls into the design, development, testing, and sustainment of information systems
- Previous success serving as the primary security engineering authority supporting system owners, ISSOs, and development teams in achieving and maintaining a system’s Authorization to Operate (ATO).
- Previous participation in design reviews, and the ability to make recommendations to mitigate risks
- Experience working with NIST SP 800-53/RMF, developing SSPs, SARs, and POA&Ms in support of ATO packages
- Experience supporting vulnerability management and remediation prioritization, and assesses the security impact of proposed system changes
- Ability to prepare effective technical security documentation
- Proven success advising ISSOs, program managers, and developers throughout the system lifecycle.
- Certifications including: CISSP, ISSEP, Security+, CASP+/SecurityX, CISM, CSSP
- The ability and willingness to work onsite 5 days a week in Washington, DC,
- An active Top Secret Clearance