Information Systems Security Engineer (ISSE) - TS required to apply - multiple locations DC, AL, WV, VA

Bow Wave LLC; Washington (District of Columbia); On-site; USD 120,000 - 180,000; Full time

Job summary

Bow Wave LLC seeks an experienced Security (Cloud a plus) Engineer (ISSE) to lead and mentor a contractor security team in implementing the RMF lifecycle for FBI IT systems. The role focuses on Prepare, system categorization, control selection, and ongoing monitoring, delivering high-quality assessments and documentation to support authorization decisions and continuous compliance.

Ideal candidates bring 8+ years of security design, analysis, and testing, with CISSP or CEH and cloud

Qualifications

• 8+ years in secure design, analysis, and test of information security systems.
• 8+ years applying methods and standards to ensure baseline safeguards are implemented and documented.
• 8+ years creating and updating security test plans to detect and mitigate risk.

Responsibilities

• Lead, mentor, and supervise contractor security professionals in RMF lifecycle implementation for FBI IT systems.
• Oversee Prepare step activities: define roles, responsibilities, and risk management strategies.
• Guide system categorization to classify information systems by impact and regulatory requirements.
• Advise on selection, tailoring, and documentation of security controls aligned with system categorizations and compliance.
• Oversee implementation of technical, operational, and management controls throughout lifecycles.
• Ensure security control assessments are planned, executed, and documented to validate safeguards.

Skills

Secure design

Security analysis

Security testing

CISSP

CEH

RMF

NIST guidelines

Cloud security

Job description

Security (Cloud a plus) Engineer (ISSE)

Work Description:

• Lead, mentor, and supervise a team of contractor security professionals responsible for the end-to-end implementation of the RMF lifecycle for FBI IT systems.
• Oversee and coordinate activities within the Prepare step, ensuring roles, responsibilities, and risk management strategies are clearly defined and maintained.
• Guide system categorization efforts to ensure all information systems are appropriately classified based on mission/business impact and regulatory requirements.
• Advise on the selection, tailoring, and documentation of security controls aligned with system categorizations, Bureau risk appetite, and compliance requirements.
• Oversee the implementation of technical, operational, and management controls throughout system and application lifecycles, with a particular focus on quality and completeness of all deliverables.
• Ensure comprehensive security control assessments are planned, executed, and documented to validate the effectiveness of implemented safeguards.
• Prepare risk management documentation for system authorization and executive decision-making.
• Direct ongoing monitoring and continuous assessment activities, collecting metrics to adjust security strategies and ensure sustained compliance.
• Serve as a principal technical advisor on cybersecurity, bringing subject-matter expertise to risk analysis, incident response, system remediation, and audit support efforts.
• Foster a culture of security awareness, providing technical guidance and training to both team members and stakeholders.
• Track, report, and communicate status, risks, and improvement opportunities related to security engineering activities to leadership and stakeholders.
• Maintain up-to-date knowledge of RMF, NIST guidance, and industry best practices in support of continuous process improvement.

Required Experience/Skills/Certifications:

• 8 years of experience in secure design, analysis, and test of information security systems and products.
• 8 years of experience applying methods, standards and approaches for ensuring the baseline security safeguards are appropriately implemented and documented.
• 8 years of experience creating and updating security test plans for detecting and mitigating risk to information systems.
• Certified Information Systems Security Professional (CISSP) or Certified Ethical Hacker (CEH) certification required
• Cloud certification preferred