Information Assurance Specialist

Strategic ACI; Alexandria (VA); On-site; USD 120,000 - 170,000; Full time

Job summary

Strategic ACI is seeking an on-site Information Assurance (IA) Specialist to manage RMF processes and DoD compliance. The role centers on developing and maintaining security artifacts such as SSPs and POA&Ms, and coordinating with the government to ensure approvals.

The ideal candidate has TS/SCI clearance and 5+ years in cybersecurity with RMF experience, including hands-on use of eMASS. Travel up to 25% may be required for CONUS/OCONUS locations.

Qualifications

• Active TS/SCI clearance required.
• 5+ years of cybersecurity experience.
• 3+ years proficiency in RMF processes.
• Experience using eMASS to manage A&A.
• DoD 8570.01-M IAM Level I or II certifications such as CISSP, CISA, Security+.

Responsibilities

• Provide guidance in developing, reviewing, and maintaining BOE such as SSPs, POA&Ms, STIGs; give strategic DoD/Army recommendations.
• Validate resolution of vulnerabilities documented in POA&Ms and provide evidence for approval.
• Support on-site and remote accreditation testing for CONUS/OCONUS locations; travel up to 25%.
• Ensure security concerns and incidents are reported to ISSMs and managed timely.
• Provide guidance on NIST SP 800-53 for managing security controls.
• Assist in creating or modifying FISMA documentation like Contingency Plans and Incident Response Plans.
• Evaluate system risk at network, system, and application levels.
• Evaluate vulnerability/STIG results and manage findings in eMASS.
• Maintain contact with government POCs to report concerns and propose COAs.

Skills

RMF processes

eMASS

A&A experience

DoD 8570 IAM I/II

Security certifications

Vulnerability management

Independent worker

Tools

eMASS tool

POA&Ms

SSP development

Job description

Strategic ACI is seeking an on-site Information Assurance (IA) Specialist specializing in RMF. The candidate will work as part of a small cybersecurity team. The candidate will manage DoD Risk Management Framework (RMF) processes and will need to be familiar with creating eMASS packages, DISA STIGs, FISMA Compliance Requirements, NIST 800 Series, and the DoD ACAS Scanning tool desired.

Responsibilities:

• Provide guidance in developing, reviewing, and maintaining security body of evidence BOE such as Security Plans (SSP), POA&Ms, STIG checklists, associated artifacts; and provide strategic recommendations in accordance with DoD and Army policies and procedures.
• Validate resolution of vulnerabilities documented in the POA&Ms and provide evidence of resolution for approval.
• Support on-site and remote site accreditation testing for networks at CONUS and OCONUS locations – travel up to 25%.
• Ensure security-related concerns and incidents are reported to ISSMs and managed timely.
• Provide guidance on NIST SP 800-53 publication for managing security controls.
• Support the creation or modification of FISMA compliancy documentation such as Contingency Plans, Incident Response Plan, Access Control Plans, etc.
• Evaluate system’s risk in respect to operation at the network, system, and application level.
• Evaluate vulnerability assessment results and STIG results and manage findings in eMASS.
• Maintain close contact with government POCs to keep abreast of progress, report concerns or issues, and offer COAs as needed.

Qualifications:

Required:

• Active TS/SCI clearance.
• 5+ years of Cybersecurity experience.
• 3+ years proficiency in RMF processes.
• Experience using and navigating eMASS tool to manage Assessment & Authorization (A&A) process.
• Possess DoD 8570.01-M IAM Level I or II certifications such as CISSP, CISA, Security+.
• Proficiency in performing risk-based reviews of Security Authorization Package.
• Ability to work independently with minimal supervision or guidance.

Desired:

• Understanding of Army IC architectures, policies, and authorities.
• Experience with Nessus Scanner.
• Experience with Security Content Automation Protocol (SCAP) tool.
• Understanding of DevSecOps, containers, cloud computing infrastructures, platforms, and services.