Senior Systems Engineer

As an Information Systems Security Engineer (ISSE) / Information Systems Security Officer (ISSO), you will serve as the primary cybersecurity subject matter expert responsible for security engineering, system authorization, compliance, and risk management activities. You will partner with system owners, engineers, architects, and government stakeholders to ensure systems maintain compliance with federal cybersecurity requirements while supporting mission objectives.
RMF & Authorization Support

• Lead and manage the Risk Management Framework (RMF) lifecycle for assigned systems.
• Develop, maintain, and update authorization artifacts including SSPs, SARs, Security Scorecards, POA&Ms, IRPs, Contingency Plans, Threat Assessments, and network boundary diagrams.
• Coordinate activities supporting Authority to Operate (ATO), Interim ATO, and system reauthorization efforts.
• Ensure cybersecurity documentation remains current and accessible to authorized personnel.

• Serve as the primary ISSO/aISSO supporting compliance with DHS, DoD, NIST, and cybersecurity requirements.
• Conduct security control assessments and ensure implementation of NIST 800-53 security controls.
• Support internal and external cybersecurity audits, inspections, and assessment activities.
• Track and report system compliance status, security findings, and overall risk posture.

• Review system architectures, data flows, interfaces, and interconnections to identify security risks and required protections.
• Provide cybersecurity engineering guidance throughout the system development lifecycle.
• Evaluate proposed system changes for security impacts and recommend mitigation strategies.
• Develop and maintain Interconnection Security Agreements (ISAs), MOUs, SLAs, and connection approval packages.

• Manage Plan of Action & Milestones (POA&M) activities from identification through closure.
• Coordinate remediation efforts across technical teams and stakeholders.
• Validate corrective actions and collect closure artifacts.
• Prepare risk acceptance packages and waiver documentation when required.

• Conduct vulnerability assessments using ACAS, Nessus, SCAP, SCC, and other approved security tools.
• Perform Security Readiness Reviews (SRRs) and support security control validation activities.
• Analyze and prioritize vulnerabilities based on risk and mission impact.
• Track remediation activities and ensure timely resolution of findings.

• Execute continuous monitoring activities in accordance with RMF requirements.
• Monitor system security posture and identify emerging threats or weaknesses.
• Review security dashboards and compliance metrics and provide recommendations for improvement.
• Support ongoing assessment and authorization activities.

• Participate in Change Control Boards (CCBs) and configuration management activities.
• Conduct Security Impact Analyses (SIAs) for system modifications and enhancements.
• Ensure cybersecurity requirements are incorporated into approved changes.

• Support incident response activities and coordinate with CGCYBER, SOC, and enterprise cybersecurity organizations.
• Investigate security events, analyze findings, and document corrective actions.
• Review HBSS/EDR reporting and support endpoint compliance efforts.
• Assist with forensic investigations and threat response activities as required.

• Perform regular reviews of audit logs, security alerts, and intrusion detection reports.
• Analyze security events and identify suspicious activity or trends.
• Review exception requests and provide security recommendations to government stakeholders.
• Document findings and support audit readiness requirements.

• Coordinate annual contingency plan testing and disaster recovery exercises.
• Support continuity planning activities and ensure documentation remains current.
• Track corrective actions resulting from testing events and exercises.

• High School Diploma and 9+ years of related cybersecurity experience (or equivalent combination of education and experience).

• DoD 8570/8140 IAT Level II certification (Security+ CE, CySA+, CCNA Security, or equivalent).
• 5+ years of experience performing ISSO, ISSE, Information Assurance, or Cybersecurity Engineering functions within a federal government environment.
• Extensive experience supporting NIST RMF authorization and accreditation processes.
• Experience developing and maintaining RMF artifacts including SSPs, SARs, POA&Ms, Security Plans, and Assessment documentation.
• Strong knowledge of NIST 800-53, FISMA, DHS cybersecurity requirements, and federal compliance frameworks.
• Experience performing vulnerability management utilizing ACAS, Nessus, DISA STIGs, and SCAP tools.
• Understanding of enterprise networking, cloud environments, system architecture, and security engineering principles.
• Experience supporting continuous monitoring, audits, inspections, and security control assessments.
• Ability to communicate cybersecurity risks to technical and non-technical stakeholders.
• Experience using enterprise ticketing and risk management platforms such as ServiceNow, Jira, Azure DevOps, or eMASS.

• Active Secret Clearance (or ability to obtain and maintain one).
• CISSP, CAP, CISM, CASP+, GSLC, or similar advanced cybersecurity certification.
• Experience supporting eMASS or other government authorization management tools.
• Knowledge of PEO C5I cybersecurity policies and authorization processes.
• Familiarity with cloud security architectures within AWS and Azure environments.
• Understanding of DevSecOps, container security, Kubernetes, and continuous ATO (cATO) concepts.
• Experience supporting Security Control Assessor (SCA) engagements and independent verification activities.