Cybersecurity Risk & Exposure Subject Matter Expert IV

Invictus International Consulting, LLC.; Alexandria (VA); On-site; USD 120,000 - 150,000; Full time

Job summary

Invictus International Consulting, LLC is seeking a senior Lead Cybersecurity Risk & Exposure SME IV to support DoD cyber defense missions from Alexandria, VA. The role requires TS/SCI with CI polygraph eligibility and delivery of risk-informed actions across vulnerability, asset, and configuration data.

You will guide SOC leadership and engineers, prioritize remediation, and drive continuous monitoring and RMF alignment while mentoring analysts and coordinating with ISSOs/ISSMs and system

Qualifications

• Bachelor's degree in a technical discipline; 4 years may substitute for degree
• Minimum of eight years of relevant experience beyond education level
• Expert knowledge of vulnerability/exposure management and risk analysis for DoD environments
• Experience with ACAS/Tenable, runZero, STIG/SCAP, and RMF/ISSO integration

Responsibilities

• Serve as senior SME for operational cyber risk, vulnerability/exposure analysis, and continuous monitoring for a DoD cyber defense mission.
• Establish methodologies to correlate vulnerability, asset, configuration, network, and control data to identify operational risk exposures.
• Lead complex exposure and impact assessments, including attack paths and remediation strategies.
• Provide expert context to SOC leadership, analysts, incident responders, and engineering teams during investigations and proactive activities.
• Lead analysis of ACAS/Tenable results, runZero data, STIG/configuration findings, and remediation priorities.
• Coordinate cyber findings with ISSOs/ISSMs, system owners, and authorization stakeholders; translate findings into mitigation and RMF actions.
• Develop checklists, guides, and reporting methods for exposure analysis, risk prioritization, and SOC-to-system coordination.
• Review remediation evidence and trends to identify systemic risk and enterprise-level actions.
• Develop briefs and dashboards communicating exposure, remediation progress, and mission impact.

Skills

Vulnerability management

Risk analysis

RMF/ISSO processes

Threat-informed analysis

Operational cyber defense

Education

Bachelor's degree in technical discipline

Tools

ACAS

Tenable

runZero

STIG/SCAP

Job description

Title: Lead Cybersecurity Risk & Exposure Subject Matter Expert IV

Location: Alexandria, VA

Clearance: TS/SCI with the ability to obtain and maintain a CI polygraph

Job Details:

• Serve as the senior SME for operational cyber risk, vulnerability/exposure analysis, and continuous monitoring supporting a DoD cyber defense mission
• Establish methodologies for correlating vulnerability, asset, configuration, network reachability, system criticality, security-control, threat, and incident data to identify and prioritize the exposures most likely to create operational or mission risk
• Lead complex exposure and impact assessments, including development of plausible exploitation scenarios, attack paths, affected-system analysis, compensating-control considerations, and risk-informed courses of action
• Provide expert vulnerability, asset, architecture, and security-control context to SOC leadership, Cybersecurity Operations Analysts, Threat Analysts, incident responders, and engineering teams during significant investigations and proactive defensive activity
• Lead analysis of ACAS/Tenable results, runZero asset information, STIG/configuration findings, system documentation, and other approved data to identify systemic weaknesses, exploitable conditions, and remediation priorities
• Own the SOC-side process for coordinating material cyber findings with affected system ISSOs/ISSMs, system owners, administrators, engineers, and authorization stakeholders; ensure operational findings are translated into appropriate mitigation, continuous-monitoring, POA&M, or RMF actions without duplicating system ISSO responsibilities
• Establish and maintain checklists, TTPs, guides, procedures, quality standards, and reporting methods for exposure analysis, risk prioritization, remediation validation, and SOC-to-system-security coordination
• Lead review of remediation evidence, recurring vulnerabilities, exposure trends, control weaknesses, and SOC-derived findings to identify systemic risk and recommend enterprise or site-level corrective actions
• Develop briefings, executive summaries, risk assessments, metrics, dashboards, and technical products that communicate operational exposure, remediation progress, control effectiveness, and mission impact to technical and leadership audiences
• Advise SOC leadership on vulnerability/exposure trends, high-risk assets, recurring security weaknesses, remediation priorities, and opportunities to improve the integration of vulnerability management, threat information, and cyber defense operations
• Mentor senior and developing analysts and provide technical quality review of exposure assessments, risk conclusions, remediation recommendations, and stakeholder coordination products
• Experience integrating vulnerability management, continuous monitoring, RMF/ISSO processes, and SOC or incident-response operations in a DoD/IC or similarly complex enterprise environment is highly desired

Requirements:

• Bachelor's degree from an accredited institute in a technical discipline applicable to the position; an additional 4 years of may be substituted in lieu of a degree
• Minimum of eight (8) years of relevant experience in addition to education level
• Demonstrated expert knowledge of vulnerability/exposure management, threat-informed risk analysis, DoD continuous monitoring, RMF/security controls, network/system security, and technical risk assessment
• Experience with ACAS/Tenable, runZero or comparable exposure/asset-discovery tools, DoD STIG/STIG Viewer, SCAP, POA&M processes, and integration of SOC/incident-response findings with ISSO/ISSM or RMF functions is highly desired
• Demonstrated experience establishing exposure-analysis methodology, leading complex risk assessments, prioritizing remediation, and translating operational cyber findings into continuous-monitoring or RMF actions is strongly desired
• Must possess current DoD 8570 IAT II or IAM II certification
• Experience working in a DoD or IC environment
• Current active TS/SCI clearance, with the ability to obtain and maintain a CI polygraph

Equal Opportunity Employer/Veteran/Disabled