Cybersecurity Engineer – Mid
Job Description:
- Assist in the development and maintenance of security authorization packages
- Support the execution of security control assessments (SCA) and prepare associated documentation
- Help develop and maintain System Security Plans (SSPs)
- Track and manage Plans of Action and Milestones (POA&M) to ensure timely remediation of findings
- Participate in security impact analyses for system changes and updates
- Support the implementation of security controls and assist with technical remediation efforts
- Assist in conducting vulnerability assessments and documenting results
- Maintain and update authorization documentation to support ATO and reauthorization efforts
- Support continuous monitoring (ConMon) activities to ensure ongoing compliance
- Collaborate with system owners, security teams, and stakeholders to support cybersecurity requirements
- Assist in developing security policies, procedures, and standard operating procedures (SOPs)
- Contribute to Security Assessment Reports (SARs) and other compliance artifacts
- Participate in security working groups, meetings, and briefings as needed
Requirements:
- Bachelor’s degree in Cybersecurity, Information Technology, Computer Science, or a related field
- 4+ years of cybersecurity experience, with a focus on Assessment & Authorization (A&A) processes
- 2+ years of direct experience working with NIST RMF and FISMA compliance requirements
- Active Security+ certification or equivalent such as SSCP or GSEC
- Ability to obtain and maintain a Public Trust clearance
- United States citizenship
- Strong knowledge of the NIST Risk Management Framework (RMF) and FISMA requirements
- Familiarity with NIST 800-53 and related security control catalogs
- Understanding of security control assessments and the A&A process lifecycle
- Ability to develop, maintain, and review security documentation including SSPs, POA&Ms, and SARs
- Familiarity with security assessment and compliance tools such as eMASS, Xacta, and Archer
- Knowledge of common security tools and technologies such as Nessus and Qualys
- Basic skills in risk assessment and security analysis
- Strong technical writing and documentation skills
- Good communication skills, both verbal and written
- Ability to work independently and as part of a team
- Additional certifications such as CASP+, CISSP (Associate), CAP, or CEH are desired
- Experience supporting classified systems or sensitive federal systems is desired
- Knowledge of Cloud Security principles and familiarity with FedRAMP compliance is desired
- Exposure to DevSecOps concepts, automated compliance, and security pipelines is desired
- Familiarity with the Cybersecurity Maturity Model Certification (CMMC) framework is desired
- Experience with continuous monitoring tools and techniques is desired
- Basic understanding of security architecture principles is desired
- Awareness of privacy requirements and associated controls is desired
- Experience with documentation management systems such as SharePoint and Confluence is desired
- Familiarity with agile development methodologies is desired
- Prior experience working in or supporting federal government contracts is desired
- Understanding of security testing methodologies, vulnerability scanning, and mitigation processes is desired
Benefits: Apply To This Job