Tenable / ACAS Administrator

CACI International Inc; Stuttgart; On-site; EUR 74,000 - 156,000; Full time

Job summary

CACI International Inc. in Stuttgart, Germany is seeking a Tenable/ACAS Administrator to manage ACAS and Tenable vulnerability scanning infrastructure across multi‑enclave networks. The role requires on‑site presence with Secret clearance and DoD RMF experience.

The candidate will administer Tenable.sc, Nessus, and distributed scanners, perform STIG audits, develop risk-based dashboards, and support remediation and documentation efforts for leadership and system owners.

Qualifications

• Secret Clearance
• Experience implementing and managing DoD RMF for classified and unclassified systems.
• Active DoD 8140/DCWF IAT/IAM Level III certification (e.g., CASP+CE, CCNP Security, CISA, CISSP, GCED, GCIH, CCSP, CISM, GSLC, CCISO).
• Minimum of 5 years monitoring system NIST compliance using workflow tools.
• Minimum of 3 years using eMASS for managing system/enclave authorizations.
• Minimum of 3 years transitioning to and operating within RMF in DoD applications.

Responsibilities

• System Administration & Infrastructure Management of Tenable.sc, Nessus, and distributed Nessus Scanners on RHEL.
• Configure and optimize scan policies, credentials, and zones for credentialed vulnerability scanning.
• Perform STIG compliance audits and SCAP benchmarking using ACAS.
• Analyze vulnerability outputs, filter false positives, and correlate with CVE/NVD.
• Export data to eMASS, VRAM, Archer, Jira, or ServiceNow and support POA&M development.

Skills

NIST SP 800-53 Rev. 5

eMASS

POA&M management

ATO / Authorization processes

ACAS tool

Tools

ACAS

Tenable.sc

Tenable.io

Nessus

Job description

Job Title: Tenable / ACAS Administrator

Job Category: Information Technology

Time Type: Full time

Minimum Clearance Required to Start: Secret

Employee Type: Regular-Long Term Assignment

Percentage of Travel Required: Up to 10%

Type of Travel: Local

* * *

The Opportunity

Are you interested in continuing your career in Europe in a mission-focused environment? CACI has an excellent opportunity for an
experienced, self-directed Information Systems Security Officer supporting U.S. Africa Command (AFRICOM) operations in Stuttgart,
Germany. This position is OCONUS and requires on-site presence.

We are seeking a qualified and experienced ACAS / Tenable Administrator to manage, maintain, and optimize our enterprise Assured Compliance Assessment Solution (ACAS) and Tenable vulnerability scanning infrastructure. In this role, you will be responsible for the end-to-end administration of Tenable SecurityCenter (Tenable.sc) / Tenable Vulnerability Management and Nessus scanners across multi-enclave operational networks.

Responsibilities

Key Responsibilities

1. System Administration & Infrastructure Management

• Deploy, configure, patch, and maintain Tenable.sc (SecurityCenter), Nessus Network Monitors (NNM), and distributed Nessus Scanners hosted primarily on Red Hat Enterprise Linux (RHEL) systems.
• Manage scanner placement, firewall port requirements, and scanning zones to ensure uninterrupted, credentialed visibility across physical, virtual, and cloud assets.
• Maintain system health, monitor disk space and database performance, and perform regular backups and disaster recovery validation of ACAS consoles and scanner repositories.
• Implement software updates, plugin updates, and license renewals across all scanning components in accordance with operational schedules.

2. Vulnerability & Compliance Scanning

• Create, schedule, and execute automated and ad-hoc credentialed network, database, and OS vulnerability scans across all designated IP subnets and enclaves.
• Configure scan policies, audit files, and credentials (SSH keys, Windows service accounts, SNMP strings) to ensure high scan success rates and low scan failure/unauthenticated scan ratios.
• Perform DISA Security Technical Implementation Guide (STIG) compliance audits and SCAP (Security Content Automation Protocol) benchmarks using ACAS.

3. Analysis, Reporting & Documentation

• Analyze raw vulnerability scan outputs, filtering false positives and correlating scan findings with Common Vulnerabilities and Exposures (CVE) / National Vulnerability Database (NVD) records.
• Generate tailored risk assessment dashboards, trend analysis reports, and executive summary briefings for leadership and system owners.
• Export and format vulnerability data for ingestion into tracking portals (e.g., eMASS, VRAM, Archer, Jira, or ServiceNow).
• Assist system owners and ISSOs in formulating Plans of Action and Milestones (POA&Ms) and preparing risk-acceptance justification packages.

4. Remediation Support & Collaboration

• Collaborate with Windows, Linux, and network infrastructure teams to communicate critical vulnerability disclosures, patch advisories (IAVAs, IAVBs, CTOs), and remediation priorities.
• Perform post-remediation verification scans to confirm vulnerability mitigations and update repository baselines.
• Participate in incident response, technical security audits, and command Cyber Security Inspection (CCRI) preparation.Qualifications

Required

Secret Clearance

Experience implementing and managing DoD RMF for classified and unclassified systems.

Working knowledge of:
NIST SP 800-53 Rev. 5
eMASS
POA&Ms management
ATO / Authorization processes
ACAS tool

At least one active Department of Defense 8140/ DCWF IAT/IAM Level III certification (e.g.,
CASP+CE, CCNP Security, CISA, CISSP, GCED, GCIH, CCSP, CISM, GSLC, CCISO).

Understanding of system controls and their impact on system security.
Minimum of 5 years monitoring system NIST compliance using workflow
tools.
Minimum of 3 years using eMASS for managing system/ enclave authorizations.
Minimum of 3 years transitioning to and operating within RMF in DoD
applications.
Experience in initial risk assessment and assisting Authorizing Official with risk determination and acceptance.
Ability to communicate effectively with technical teams and senior government leadership.

Desired

Experience supporting AFRICOM, JFHQ-DODIN, or Combatant Command environments.

Experience with:
3–5+ years of hands‑on experience in cybersecurity, systems administration, or vulnerability management.

At least 2 years of direct operational experience administering ACAS, Tenable.sc, or Tenable.io and distributed Nessus scanners.

What You Can Expect:

A culture of integrity.

At CACI, we place character and innovation at the center of everything we do. As a valued team member, you’ll be part of a high-performing group dedicated to our customer’s missions and driven by a higher purpose – to ensure the safety of our nation.

An environment of trust.

CACI values the unique contributions that every employee brings to our company and our customers - every day. You’ll have the autonomy to take the time you need through a unique flexible time off benefit and have access to robust learning resources to make your ambitions a reality.

A focus on continuous growth.

Together, we will advance our nation’s most critical missions, build on our lengthy track record of business success, and find opportunities to break new ground — in your career and in our legacy.

Pay Range :

There are a host of factors that can influence final salary including, but not limited to, geographic location, Federal Government contract labor categories and contract wage rates, relevant prior work experience, specific skills and competencies, education, and certifications. Our employees value the flexibility at CACI that allows them to balance quality work and their personal lives. We offer competitive compensation, benefits and learning and development opportunities. Our broad and competitive mix of benefits options is designed to support and protect employees and their families. At CACI, you will receive comprehensive benefits such as; healthcare, wellness, financial, retirement, family support, continuing education, and time off benefits.

The proposed salary range for this position is:

$82,700 - 173,900 USD

CACI is anEqualOpportunity Employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, pregnancy, sexual orientation, age, national origin, disability, status as a protected veteran, or any otherprotectedcharacteristic.