Information Assurance Specialist IV

OneZero Solutions; Arlington (VA); On-site; USD 120,000 - 150,000; Full time

Benefits offered by this job

Health Insurance

Dental Insurance

Vision Insurance

Life Insurance

401(k) with company matching

Paid time off and holidays

Employee referral program

Educational assistance

Job summary

OneZero Solutions, LLC is seeking an Information Assurance Specialist IV in Arlington, VA or Mechanicsburg, PA to lead senior ISSO and SCA activities in a cloud-native DevSecOps environment. You will drive RMF/CSRMC implementations, automate control evidence, and develop authorization artifacts to support ATO/CATO outcomes.

Requirements include a Bachelor's in a technical field, DoW IAM II/IAT II baseline, five years IA experience with three in DoD cybersecurity, and an active Secret clearance;

Qualifications

• Bachelor’s degree in IT, CS, Engineering or related technical field.
• DoW 8570/8140 IAM II or IAT II baseline certification required.
• Five years of dedicated IA experience with three consecutive years.
• Active Secret clearance and US citizenship.
• Hands-on CS/ISSO experience in RMF environments.

Responsibilities

• Serve as ISSO for DSCA IM&T portfolio systems and protect data confidentiality, integrity, and availability.
• Lead RMF/CSRMC implementation in a cloud-native DevSecOps environment and enable accreditations.
• Automate security control implementation and evidence collection.
• Develop SAP, SAR, and Authorization artifacts and maintain ATO documentation.
• Perform SCA-V duties: validate content and evidence, review CaC/PaC scripts.
• Maintain eMASS as the system of record and document findings.
• Provide risk analysis, POA&M support, and mitigation recommendations.
• Brief stakeholders on assessment results and residual risk.

Skills

RMF

eMASS

SCA-V

ISSO

Security Analysis

Education

Bachelor's degree in IT/CS/Engineering

DoW 8570/8140 IAM II or IAT II baseline

Tools

eMASS

Job description

We are an employee-centric company that truly values our team members and the contributions they make to our customers and the missions they support. We pride ourselves on being forward-leaning thinkers and on building teams that are, and continue to be, technically proficient across a broad range of cyber mission areas. OneZero full-time employees receive a highly competitive benefits package, including health, dental, vision, and life insurance, a 401(k) with company matching, paid time off and holidays, an employee referral program, and educational assistance. Additional details are available on our website: https://www.onezerollc.com/careers/.

Position Title: Information Assurance Specialist IV

Location: Arlington, VA or Mechanicsburg, PA

Clearance: Secret

Job Summary: The Information Assurance Specialist IV is key personnel providing senior Information System Security Officer (ISSO), Security Control Assessor (SCA), and Security Controls Validator (SCA-V) support across DSCA's five IM&T. The role ensures the confidentiality, integrity, and availability of data on assigned systems, leads operationalization of RMF/CSRMC in a cloud-native DevSecOps environment, and drives automation of control implementation, evidence collection, and authorization artifacts in support of A&A, Assess Only, and continuous ATO (cATO) outcomes.

Education and Experience:

• Bachelor's degree from an accredited institution in Information Technology, Computer Science, Engineering, or a related technical discipline.
• Current DoW 8570/8140 certification meeting the IAM Level II or IAT Level II baseline requirement (e.g., CISSP, Security+ CE, CISM, CASP+ CE).
• Five (5) years of dedicated Information Assurance experience, with at least three (3) of those years being consecutive.
• Three (3) consecutive years directly relevant to the tasks above, demonstrating a hands-on understanding of the DoW cybersecurity environment.
• Active Secret clearance; U.S. citizenship required.

Essential Duties:

• Serving as ISSO for assigned DSCA IM&T portfolio systems, ensuring confidentiality, integrity, and availability of data residing on or transiting those systems.
• Leading operationalization of the RMF/Cybersecurity Risk Management Construct (CSRMC) within a cloud-native, DevSecOps framework, and automating security control implementation and evidence collection to achieve and maintain A&A, Assess Only, and cATO accreditations.
• Proactively identifying and mitigating security weaknesses and maintaining accurate, current security documentation.
• Developing the Security Assessment Plan (SAP) and conducting ongoing assessments of security controls beyond periodic compliance checks.
• Providing actionable risk analysis that prioritizes vulnerabilities and control deficiencies, and interpreting and validating outputs of automated validation tools and Policy-as-Code scripts.
• Developing and maintaining key authorization artifacts, including the Security Assessment Report (SAR), the Authorization Recommendation Memo, and the program's overarching ATO documentation.
• Performing SCA-V duties: validating security and compliance content, assessing CaC profiles and scripts, and verifying that automated compliance evidence is correctly ingested and reflected.
• Maintaining the eMASS record as the system of record, documenting all assessment activities, findings, and evidence in a timely and accurate manner.
• Performing in-depth risk analysis and POA&M support and providing written recommendations for mitigation and validation of proposed corrective actions.
• Preparing and assembling the Security Authorization Package and briefing the SCA, ISSM, and other stakeholders on assessment results and residual risk.

Knowledge, Skill and Abilities:

• Expert knowledge of RMF, NIST SP 800-53, DISA STIGs, and the Cybersecurity Risk Management Construct (CSRMC).
• Master-level proficiency in eMASS as the authoritative system of record for assessment and authorization data.
• Familiarity with FedRAMP, DoW Impact Levels, and the DoW Cloud Computing Security Requirements Guide (CCSRG).
• Hands-on experience securing AWS cloud-native architectures and authorized SaaS solutions.
• Ability to review and validate Compliance-as-Code (CaC) and Policy-as-Code (PaC) profiles, scripts, and automated compliance evidence.
• Skill in risk analysis, POA&M development, and drafting decision-quality authorization documentation (SAP, SAR, Authorization Recommendation Memo).

Clear, no-surprises reporting and effective collaboration with system owners, ISSMs,

OneZero Solutions, LLC is an Equal Opportunity employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, age, pregnancy, genetic information, disability, status as a protected veteran, or any other protected category under applicable federal, state, and local laws.

To request an accommodation, please contact us at [e-mail] or call [phone].