Cyber Security Specialist

Gridiron IT; Fort Meade (MD); On-site; USD 110,000 - 155,000; Full time

Benefits offered by this job

Medical, dental, and vision insurance

HSA and FSA

401(k) with employer matching

Disability & ADD insurance

Life insurance

Pet insurance

Job summary

GridIron IT in the United States is seeking a Senior Cyber Specialist to serve as an Information System Security Officer (ISSO) responsible for day-to-day security posture, authorization, and continuous monitoring of enterprise information systems.

You will own security control implementation, RMF activities, and the artifacts required to obtain and sustain authorization to operate, coordinating with engineering teams and authorizing officials to translate risk into actionable improvements.

Qualifications

• Bachelor’s degree or equivalent experience with 12+ years of prior relevant experience, or Master’s degree with 10+ years of experience.
• Current IAT Level II or higher certification, such as Security+ or CISSP.

Responsibilities

• Serve as ISSO for assigned systems and be the principal cybersecurity point of contact.
• Execute RMF activities across categorization, control selection, implementation, assessment, authorization, and continuous monitoring.
• Develop, maintain, and defend authorization packages including the System Security Plan and supporting artifacts.
• Maintain system records and artifacts in eMASS or designated repository with current control status and documentation.
• Develop and track Plans of Action and Milestones (POA&Ms) with risk justification and mitigation approaches.
• Support security assessments, audits, inspections, and command cyber readiness activities.
• Partner with engineering teams to ensure security requirements are designed in from the start.
• Advise leadership on cybersecurity risk and remediation options.

Education

Bachelor’s degree or equivalent experience (12+ years)

Master’s degree with 10+ years of experience

Job description

Position Summary: GridIron IT is seeking a Senior Cyber Specialist to serve as an Information System Security Officer (ISSO) responsible for the day-to-day security posture, authorization, and continuous monitoring of enterprise information systems. The role owns the security control implementation and accreditation artifacts for assigned systems and serves as the principal point of contact for cybersecurity matters affecting them.

This position is responsible for ensuring assigned systems are built, documented, assessed, and operated in accordance with applicable federal and DoD cybersecurity requirements. Duties include security control implementation and validation, risk assessment, vulnerability and compliance oversight, incident support, and the development and maintenance of the artifacts required to obtain and sustain an authorization to operate.

The successful candidate is a cybersecurity practitioner who works comfortably between the engineering teams who build the system and the authorizing officials who must accept its risk, translating technical reality into defensible control documentation and translating control requirements into changes engineers can actually implement.

Primary Responsibilities

Authorization and Risk Management Framework

• Serve as ISSO for assigned systems, maintaining the system security posture and acting as the principal cybersecurity point of contact for those systems.
• Execute Risk Management Framework (RMF) activities across categorization, control selection, implementation, assessment, authorization, and continuous monitoring.
• Develop, maintain, and defend authorization packages, including the System Security Plan, security control implementation statements, risk assessment reports, contingency and incident response plans, and supporting artifacts.
• Maintain system records and artifacts in eMASS or the designated authorization repository, keeping control status, assessment results, and documentation current and accurate.
• Develop and track Plans of Action and Milestones (POA&Ms), including risk justification, mitigation approach, compensating controls, and milestone closure evidence.
• Support security assessments, audits, inspections, and command cyber readiness activities, including evidence collection and assessor coordination.
• Evaluate proposed system and architecture changes for security impact, and provide written recommendations on acceptance, mitigation, or denial.

Vulnerability, Compliance, and Continuous Monitoring

• Oversee vulnerability management for assigned systems, including scan review, validation, prioritization, remediation tracking, and reporting against required timelines.
• Oversee DISA STIG and security configuration compliance, including baseline review, deviation justification, and verification of applied hardening.
• Review and act on cybersecurity directives, bulletins, advisories, and tasking orders applicable to assigned systems, and track compliance to closure.
• Perform continuous monitoring activities, including control status review, log and audit record oversight, account and privilege review, and security posture reporting.
• Support incident response and reporting, including initial analysis, documentation, coordination with the security operations team, and after-action tracking of corrective measures.

Engineering Partnership and Advisory

• Partner with network, systems, cloud, application, and operations engineering teams to ensure security requirements are designed in rather than retrofitted.
• Provide practical security guidance on architecture and implementation decisions, including boundary definition, access control, encryption, auditing, and least privilege.
• Advise program leadership and government stakeholders on cybersecurity risk, control posture, remediation options, and the security implications of schedule and design decisions.
• Mentor junior cybersecurity staff and provide technical direction on assessment, documentation, and remediation work.
• Improve cybersecurity processes, templates, evidence standards, and reporting to reduce rework and shorten authorization timelines.

Documentation

• System Security Plans and control implementation statements
• System boundary descriptions, data flow diagrams, and hardware/software inventories
• Risk assessment reports and security impact analyses
• Plans of Action and Milestones with supporting evidence
• Contingency, continuity, and incident response plans
• Configuration and hardening baselines and deviation justifications
• Continuous monitoring and security posture reports
• Standard operating procedures for recurring security activities

Required Qualifications

• Bachelor’s degree or equivalent experience and 12+ years of prior relevant experience, or Master’s degree with 10+ years of experience. Specific experience, education, and training may be considered in lieu of a degree.
• Current IAT Level II or higher certification, such as Security+ or CISSP.

Clearance: Applicants selected will be subject to a security investigation and may need to meet eligibility requirements for access to classified information.

Compensation and Benefits

Salary Range: $110,000-$155,000 (Compensation is determined by various factors, including but not limited to location, work experience, skills, education, certifications, seniority, and business needs. This range may be modified in the future.)

Benefits: Gridiron offers a comprehensive benefits package including medical, dental, vision insurance, HSA, FSA, 401(k), disability & ADD insurance, life and pet insurance to eligible employees. Full-time and part-time employees working at least 30 hours per week on a regular basis are eligible to participate in Gridiron’s benefits programs.

Gridiron IT Solutions is an Equal Opportunity Employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, pregnancy, sexual orientation, gender identity, national origin, age, protected veteran status or disability status.

Gridiron IT is a Women Owned Small Business (WOSB) headquartered in the Washington, D.C. area that supports our clients' missions throughout the United States. Gridiron IT specializes in providing comprehensive IT services tailored to meet the needs of federal agencies. Our capabilities include IT Infrastructure & Cloud Services, Cyber Security, Software Integration & Development, Data Solution & AI, and Enterprise Applications. These capabilities are backed by Gridiron IT's experienced workforce and our commitment to ensuring we meet and exceed our clients' expectations.