Description- Auditing of system security security controls, STIG configurations, and ACAS scans
- Supporting the Cyber Test process for system accreditation and Risk Management Framework (RMF) processes
- Executing continuous monitoring of systems to include vulnerability analysis, IAVM reporting, and validation of security controls in support of ATO requirements
- The information gathered during these activities will be used to create and maintain associated POA&Ms and to track the systems security posture
- Performing Assess and Authorize (A&A) duties within Risk Management Framework (RMF) with knowledge of Department of Navy Risk Management Framework Process Guide, NIST Special Publications, Enterprise Mission Assurance Support Service (eMASS)
- Conducting Cyber Security (CS) analysis, mitigation, remediation, and monitoring to ensure compliance with applicable DoD and Department of the Navy (DON) policies, procedures, and regulations
- Working within VRAM to perform daily/weekly activities to include but are not limited to EXORD, FRAGO, and CTO concurrence and acceptance
- Reviewing of site scan uploads and verification of asset compliancy
- Compiling and analysis of VRAM data and reporting findings to Team Lead
#LI-KS1
Requirements- Detail-oriented and analytical Cyber Tester with strong knowledge of Windows OS (Active Directory, Group Policy Objects, PowerShell), Linux/Unix OS (RHEL configuration, SSH, privilege escalation, file permissions), and Virtualization (VMware vSphere/ESXi)
- Execute, monitor, and analyze automated vulnerability and compliance scans utilizing ACAS (Assured Compliance Assessment Solution) / Tenable Nessus
- Perform rigorous Security Technical Implementation Guide (STIG) checks and run Security Content Automation Protocol (SCAP) tools to evaluate operating systems, network devices, and applications against federal/defense standards
- Utilize STIG Viewer (v2 and v3) to create, import, edit, and consolidate .ckl and .cklb compliance checklist files for system artifacts
- Utilize eMASSter (and related scripting frameworks) to ingest, process, parse, and aggregate vulnerability scan data, STIG checklists, and ACAS .nessus outputs
- Diagnose and resolve complex issues related to scanning failures, credentialed scan errors, network access blocks, and tool misconfigurations across diverse environments
- Review scan outputs, filter out false positives, assess risk levels, and generate comprehensive compliance reports for stakeholders and RMF (Risk Management Framework) packages
- This position requires a highlevel of customer management and communication
- Minimum Security+ CE certification
Desired Skills- VRAM (Vulnerability Remediation Asset Manager) Familiarity:
- Export compliant scan results (.nessus or certified XML formats) from ACAS SecurityCenter/Tenable.sc to VRAM
- Format, validate, and upload vulnerability scan data into VRAM, ensuring proper mapping of assets
- Monitor and analyze VPH (Vulnerability Priority Health) numbers, tracking metrics for Relevant Assets (RA), Non-Relevant Assets (NRA), and open vulnerabilities
- Identify negative performance trends, high-risk delta spikes, and stale data to brief leadership on the command's current vulnerability posture
- Process and track IAVMs (Information Assurance Vulnerability Management) and FCB (Field Change Bulletin) notices
- Experience being a Navy Qualified Validator
- OS certification (Linux+, RHEL, Microsoft, Cisco CCENT/CCNA)
Clearance InformationSRC IS A CONTRACTOR FOR THE U.S. GOVERNMENT, THIS POSITION WILL REQUIRE U.S. CITIZENSHIP AS WELL AS, A U.S. GOVERNMENT SECURITY CLEARANCE AT THE TOP SECRET LEVEL WITH TOP SECRET / SCI ELIGIBILITYTravel RequirementsAbout UsScientific Research Corporation is an advanced information technology and engineering company that provides innovative products and services to government and private industry, as well as independent institutions. At the core of our capabilities is a seasoned team of highly skilled engineers and scientists with multidisciplinary backgrounds. This team is challenged daily to provide cutting edge technology solutions to our clients.
SRC offers a generous benefit package, including medical, dental, and vision plans, 401(k) with a company match, life insurance, vacation and sick paid time off accruals with amounts increasing based on role and years of service, 11 paid holidays, tuition reimbursement, and a work environment that encourages excellence and more. For positions requiring a security clearance, selected applicants will be subject to a government security investigation and must meet eligibility requirements for access to classified information.
EEOScientific Research Corporation is an equal opportunity employer that does not discriminate in employment.
All qualified applicants will receive consideration for employment without regard to their race, color, religion, sex, age, sexual orientation, gender identity, national origin, disability, protected veteran status, or any other protected characteristic under federal, state or local law.
Scientific Research Corporation endeavors to make accessible to any and all users. If you would like to contact us regarding the accessibility of our website or need assistance completing the application process, please contact for assistance. This contact information is for accommodation requests only and cannot be used to inquire about the status of applications.
