Cybersecurity Subject Matter Expert (SME) Secret or Top-Secret

Creative Solutions Services, LLC; Washington (District of Columbia); On-site; USD 140,000 - 170,000; Full time

Job summary

IBSS Corp. in Washington, DC seeks a Cybersecurity Subject Matter Expert (SME) to lead information assurance activities on a Federal contract. The role focuses on IA engineering, risk and vulnerability assessments, and security evaluations to maintain compliance with NIST, FISMA, and DOC policies.

The SME will work with security engineers, ISSOs, and customer leadership to sustain an ATO portfolio, develop policies, and ensure secure system design throughout the lifecycle.

Qualifications

• Bachelor's degree or higher in a related field.
• 8+ years of professional cybersecurity experience.
• CISSP or similar certification (CISM, CASP+, GSLC, etc.).
• Working knowledge of NIST SP 800-53, FISMA, and RMF/ATO processes.
• Experience conducting risk and vulnerability assessments and developing test plans.

Responsibilities

• Lead IA engineering, risk and vulnerability assessments and security evaluation activities.
• Develop and document security evaluation test plans and procedures; conduct hands-on testing and document risk.
• Review program documentation and propose security improvements at the system level.
• Ensure compliance with NIST and FISMA; support continuous monitoring activities.
• Coordinate with system owners, ISSOs, and leadership to address IA concerns.

Skills

Cybersecurity experience

NIST SP 800-53 knowledge

Clear communication

Security policy briefing

Education

Bachelor's degree (Info Tech / CS / Business / related)

Tools

CISSP or equivalent

Job description

Job Title: Cybersecurity Subject Matter Expert (SME)

Location: Washington, DC

Clearance Required: Active Secret or Top-Secret (TS) Clearance

Salary: $140k-$170K Based on Years of Experience

Application Deadline: September 30, 2026

Description

IBSS is seeking a Cyber Security Subject Matter Expert (SME) to support a Federal customer. This position serves as the principal information assurance and cybersecurity expert on the contract, leading IA engineering, risk and vulnerability assessments, and security evaluation activities that protect NTIA's classified and unclassified systems, data, and networks and that maintain compliance with NIST, FISMA, and Department of Commerce (DOC) security policy. The Cyber Security SME works closely with the security engineer, ISSOs/Security Assessors, and customer leadership to sustain a strong security posture and Authority to Operate (ATO) portfolio.

Key Responsibilities

• Provide enhancement capabilities and standard operating procedures (SOPs) to assessment operations for execution and implementation.
• Maintain accountability for the integrity and confidentiality of the security assessment process; provide in-depth analysis of vulnerabilities across customer systems.
• Review and make recommendations on program-level documentation, including requirements specifications, system architecture, design documents, test plans, and security plans.
• Develop and document security evaluation test plans and procedures; conduct hands-on security testing, analyze results, document risk, and recommend countermeasures.
• Assess and calculate risk based on threats, vulnerabilities, and shortfalls uncovered in testing, and identify mitigating countermeasures.
• Provide oversight of the design, development, and implementation of security-related support systems.
• Research, evaluate, and develop Information Security policies and guidance.
• Develop, review, and update Information Assurance (IA) policies, procedures, and guidelines to keep NTIA systems aligned with evolving federal security requirements and enterprise governance expectations.
• Perform comprehensive risk and vulnerability assessments; document findings and recommend mitigation and remediation strategies to reduce organizational exposure to cyber threats.
• Ensure compliance with federal cybersecurity regulations, including NIST and FISMA, by reviewing security controls, identifying gaps, and supporting continuous monitoring activities.
• Develop and maintain system- and enterprise-level IA documentation, including System Security Plans (SSPs), risk assessments, control implementation statements, POA&Ms, and audit-ready ATO artifacts.
• Support system security engineering activities, ensuring security requirements are incorporated into system design, architecture, and configuration baselines throughout each system's lifecycle.
• Coordinate with system owners, ISSOs, architecture teams, and cybersecurity leadership to validate system requirements, address IA concerns, and resolve compliance or security issues.
• Monitor IA-related compliance activities, ensuring artifacts, assessments, and system configurations remain aligned with NIST SP 800-53 controls, agency policy, and Department directives.
• Actively participate in or lead technical exchange meetings, document action items and results, and brief customer leadership on the status of activities and risk findings.

Required Skills /Education/ Certifications & Qualifications

• Bachelor's degree in Information Technology, Computer Science, Business Management, or a related field.
• Minimum of eight (8) years of professional cybersecurity experience.
• CISSP or similar (CISM, CASP+, GSLC, etc.) recognized cybersecurity certification.
• Working knowledge of NIST SP 800-53, FISMA, and federal Risk Management Framework / ATO processes.
• Demonstrated experience conducting risk and vulnerability assessments and developing security evaluation test plans and procedures.
• Strong written and verbal communication skills, with experience briefing technical findings to leadership and government stakeholders.
• Active Secret Clearance required.

Desired Skills

• Experience supporting the Department of Commerce or another Federal Civilian Executive Branch (FCEB) agency's cybersecurity or information assurance program.
• Experience developing and maintaining ATO documentation (SSPs, SARs, POA&Ms) within a NIST Risk Management Framework or FedRAMP environment.
• Experience coordinating with Security Operations Center (SOC) or incident response teams on continuous monitoring and mitigation activities.
• Additional certifications such as CISM, CAP, Security+, or CEH.

About IBSS Corp.

Since 1992, IBSS, a woman-owned small business, has provided transformational consulting services to the Federal defense, civilian, and commercial sectors. Our services include cybersecurity and enterprise information technology, environmental science and engineering (including oceans, coasts, climate, and weather), and professional management services.

Our approach is to serve our employees by investing in their growth and development. As a result, our employees bring greater capabilities and provide exceptional service to our clients. In addition to creating career development opportunities for our employees, IBSS is passionate about giving back to the community and serving the environment. We strive to leave something better behind for the next generation.

We measure our success by the positive impact we have on our employees, clients, partners, and the communities we serve. Our tagline, Powered by Excellence, is a recognition of the employees that make up IBSS and ensures we deliver results with quality, applying industry best practices and certifications.

IBSS offers a competitive benefits package that includes medical, dental, vision, and prescription drug coverage with a company-paid deductible, paid time off, federal holidays, a matching 401K plan, tuition/professional development reimbursement, and Flex-Spending (FSA)/Dependent Care Account (DCA) options.

IBSS is an affirmative action and equal opportunity employer. All qualified applicants will be considered for employment without regard to race, color, religion, sex, disability, age, sexual orientation, gender identity, national origin, veteran status, or genetic information. Click https://www.eeoc.gov/poster to see that the EEO is the law. Please direct any inquiries to the HR Department email at [e-mail].

If you require reasonable accommodation in completing this application, interviewing, completing any pre-employment testing, or otherwise participating in the employee selection process, please direct your inquiries to the Talent Acquisition Department at [e-mail].