InfoSec Engineer III

Quivera Enterprises, LLC; Northern (KY); Hybrid; USD 90,000 - 140,000; Full time

Benefits offered by this job

Equal opportunity employer

Tribally owned

Job summary

Quivera Enterprises LLC is seeking a seasoned cybersecurity professional to lead RMF implementation and risk management activities across complex systems. You will coordinate security assessments, develop authorization packages, and map controls to NIST SP 800-53 while supporting zero trust and enterprise security initiatives.

The role requires deep knowledge of RMF, STIGs, vulnerability management, and SDLC security, with a focus on risk reduction and continuous monitoring in a federal

Qualifications

• Extensive experience implementing NIST RMF for federal systems.
• Experience conducting security assessments and developing authorization packages.
• Strong knowledge of STIG controls and their validation.

Responsibilities

• Lead RMF implementation and authorization activities across systems.
• Conduct security assessments and deliver authorization packages.
• Develop and maintain security documentation for A&A activities.
• Evaluate control effectiveness and coordinate remediation with stakeholders.
• Support SDLC security integration and disaster recovery requirements.

Skills

NIST RMF

Security assessments

STIG compliance

Zero Trust

Vulnerability management

Contingency planning

SDLC security

Policy development

Threat analysis

Security documentation

Education

Bachelor's degree in Cybersecurity

Master's degree in related field

Eight years of experience without a degree

Tools

STIG tooling

NIST 800-53 tooling

Security assessment tools

Job description

If you are unable to complete this application due to a disability, contact this employer to ask for an accommodation or an alternative application process.

US

This position is contingent upon contract award

Key Responsibilities

Risk Management Framework (RMF) & Assessment and Authorization

• Provide senior-level technical support for the implementation and execution of the Risk Management Framework in accordance with NIST guidance and applicable federal and Departmental requirements.
• Support security categorization, security control selection, implementation, assessment, authorization, and continuous monitoring activities.
• Conduct security assessments and develop required deliverables supporting system authorization packages.
• Implement, evaluate, test, and document technical, management, and operational security controls in accordance with NIST SP 800-53.
• Develop and maintain security documentation supporting A&A and ongoing authorization activities.
• Evaluate security control effectiveness and identify deficiencies, vulnerabilities, risks, and required corrective actions.
• Support system owners and technical teams throughout the authorization lifecycle.
• Provide recommendations regarding system authorization readiness and cybersecurity risk.

Security Control Assessment & STIG Compliance

• Lead the implementation, validation, and periodic verification of applicable Security Technical Implementation Guide (STIG) controls.
• Execute STIG control assessments according to the cadence established by agency leadership.
• Develop and maintain STIG control documentation and supporting evidence.
• Evaluate system configurations and security baselines against federal and agency security requirements.
• Identify STIG-related findings, compliance gaps, and security weaknesses.
• Recommend corrective actions, compensating controls, and mitigation strategies.
• Coordinate with system administrators, engineers, developers, and security personnel to remediate identified findings.
• Validate remediation activities and document resulting security posture improvements.

Risk & Vulnerability Management

• Develop comprehensive Risk Assessments in accordance with NIST guidance and applicable agency requirements.
• Deliver risk analysis, findings, recommendations, and strategic guidance to Associate Chief Information Officer (ACIO) leadership and other stakeholders as required.
• Conduct vulnerability analyses and evaluate identified weaknesses for potential mission, operational, and security impacts.
• Develop mitigation plans and recommendations addressing identified cybersecurity risks.
• Assist senior management with establishing Plans of Action for remediation of organization-wide weaknesses.
• Track cybersecurity weaknesses and remediation activities through resolution.
• Support configuration management, contingency planning, and disaster recovery security requirements.
• Identify systemic cybersecurity risks and recommend enterprise-level corrective actions.

Security Policy & Program Development

• Develop cybersecurity policies, procedures, standards, directives, and Standard Operating Procedures (SOPs) supporting federal regulations and Departmental policies.
• Provide strategic guidance for the continued development and maturation of the IA security program.
• Review existing cybersecurity policies and procedures and recommend improvements.
• Assist OIT and other IA offices and divisions with integrating security requirements into operational and technical processes.
• Promote consistent implementation of security controls and cybersecurity practices throughout the organization.
• Support the development of enterprise security architectures, standards, and governance processes.

Zero Trust & Enterprise Security Architecture

• Provide technical and strategic guidance supporting the implementation and maturation of Zero Trust Architecture principles.
• Direct and support security initiatives designed to improve operational efficiencies and strengthen enterprise cybersecurity.
• Promote an enterprise-wide and global security mindset across technology and program environments.
• Evaluate existing architectures and technical solutions for alignment with Zero Trust principles and federal cybersecurity requirements.
• Identify security architecture gaps and recommend appropriate technical and procedural solutions.
• Support integration of identity, endpoint, network, application, data, and infrastructure security requirements into enterprise architecture.

System Development Life Cycle Security

• Provide strategic guidance and continuous support for integrating cybersecurity throughout the System Development Life Cycle (SDLC) across IA.
• Provide information assurance guidance for the development and modification of information systems and industrial control systems.
• Evaluate proposed applications, systems, technologies, and changes to existing systems for potential cybersecurity impacts.
• Identify security gaps associated with new or modified systems and recommend appropriate solutions.
• Integrate security requirements into system planning, design, development, implementation, operations, and sustainment activities.
• Assist project managers with security oversight and cybersecurity requirements throughout the project lifecycle.
• Provide OIT with recommendations regarding cybersecurity considerations for new and existing projects.

Security Incident Management

• Support security incident management processes and protocols established by DISA, applicable federal agencies, and Departmental requirements.
• Participate in cybersecurity incident identification, analysis, response, containment, remediation, and reporting activities.
• Evaluate incidents to identify root causes, vulnerabilities, and potential control deficiencies.
• Recommend corrective actions following cybersecurity incidents.
• Support the development and maintenance of incident response procedures.
• Coordinate with cybersecurity, infrastructure, operational, and leadership teams during incident response activities.
• Incorporate lessons learned from incidents into security controls, policies, and procedures.

Continuous Monitoring & Security Operations

• Support continuous monitoring activities to evaluate the ongoing effectiveness of security controls.
• Monitor vulnerabilities, configuration changes, security findings, remediation activities, and other indicators of enterprise cybersecurity risk.
• Analyze continuous monitoring results and recommend corrective actions.
• Support ongoing authorization and security posture reporting activities.
• Identify trends and systemic weaknesses affecting enterprise security.
• Recommend improvements to security controls, processes, monitoring capabilities, and reporting.

Federal Security Coordination & Advisory Support

• Provide recommendations to OIT and other IA offices and divisions regarding the integration of security processes and compliance with federal regulations and Departmental policies.
• Coordinate with representatives and Subject Matter Experts (SMEs) from other federal agencies and commercial organizations.
• Maintain awareness of emerging cybersecurity regulations, standards, technologies, threats, and industry practices.
• Assess the potential impact of regulatory and technology changes on IA systems and cybersecurity programs.
• Provide technical recommendations to leadership regarding cybersecurity initiatives, risks, and priorities.
• Participate in technical meetings, cybersecurity working groups, architecture reviews, and security governance activities.
• Prepare technical reports, briefings, risk analyses, and recommendations for technical and executive stakeholders.
• Perform other related duties as assigned.

Required Qualifications

Education & Experience

• Bachelor's degree in Cybersecurity, Information Technology, Computer Science, Information Systems, Engineering, or a related technical field and a minimum of six (6) years of relevant experience; OR
• Master's degree in a related technical discipline and a minimum of five (5) years of relevant experience; OR
• Minimum of eight (8) years of relevant professional experience without a degree.

An industry-recognized technical certification may be accepted in lieu of one (1) year of experience, subject to contract requirements.

In addition, candidates must have a minimum of five (5) years of direct, full-time experience conducting security assessments and developing required deliverables within system authorization packages.

Required Knowledge, Skills & Abilities

• Extensive knowledge and practical experience implementing standard methodologies used within the NIST Risk Management Framework.
• Expert-level knowledge of NIST SP 800-53 security and privacy controls.
• Demonstrated experience implementing, evaluating, testing, and documenting technical, management, and operational security controls.
• Experience developing and implementing federal STIG controls.
• Strong knowledge of federal IT security policies, procedures, architectures, standards, and SOPs.
• Experience conducting comprehensive security assessments and developing system authorization package deliverables.
• Expert knowledge of risk assessment and risk management methodologies.
• Extensive experience conducting vulnerability analyses and developing mitigation plans.
• Knowledge of contingency planning and disaster recovery requirements.
• Experience with configuration management and secure configuration practices.
• Experience supporting federal security incident management processes and protocols.
• Knowledge of DISA and other applicable federal cybersecurity standards and guidance.
• Understanding of Zero Trust Architecture principles and federal Zero Trust initiatives.
• Experience integrating cybersecurity requirements throughout the SDLC.
• Ability to assess security impacts associated with new applications, technologies, system modifications, and enterprise projects.
• Strong technical writing, analytical, documentation, and problem-solving skills.
• Ability to communicate complex cybersecurity risks and technical concepts to both technical and non-technical stakeholders.
• Ability to provide strategic cybersecurity recommendations to senior leadership.
• Ability to work independently and collaboratively within complex federal environments.

Preferred Qualifications

• Experience supporting Indian Affairs, the Department of the Interior, or another federal agency cybersecurity program.
• Experience providing cybersecurity support to federal OIT or CIO organizations.
• Experience developing and maturing enterprise cybersecurity programs.
• Experience implementing or supporting Zero Trust Architecture within federal environments.
• Experience assessing information systems and industrial control systems.
• Experience supporting federal continuous monitoring and ongoing authorization programs.
• Experience with federal STIG implementation and verification.
• Experience developing enterprise security policies, architectures, standards, and SOPs.
• Experience advising senior federal leadership regarding cybersecurity risk and remediation strategies.
• Relevant industry-recognized cybersecurity certifications such as CISSP, CGRC, CISM, SecurityX/CASP+, Security+, or equivalent certifications.

Clearance & Security Requirements

• Must have the ability to successfully complete the required federal background investigation.
• Must have the ability to obtain and maintain the required Government security clearance, suitability determination, or Public Trust designation as required by the contract.
• Must comply with all applicable federal customer security, privacy, confidentiality, cybersecurity, and information assurance requirements.

Physical Demands

The physical demands described here are representative of those that must be met by an employee, with or without reasonable accommodation, to successfully perform the essential functions of this position.

This position is primarily performed in a professional office or technical environment and requires prolonged periods of sitting and working at a computer. The employee must be able to:

• Frequently use computers and standard office equipment.
• Communicate effectively through verbal, written, and electronic means.
• Maintain visual acuity necessary for reviewing technical documentation, security assessment results, system configurations, diagrams, and computer displays.
• Occasionally stand, walk, bend, reach, and lift or carry standard office or computer equipment.
• Work extended or irregular hours when required to support security assessments, cybersecurity incidents, system implementations, or other mission requirements.

Quivera Enterprises LLC and its subsidiaries are 100% tribally owned and SBA-certified Small Disadvantaged Businesses. We are proud to be an Equal Opportunity Employer and are committed to creating an inclusive workplace where all qualified applicants receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, age, disability, protected veteran status, or any other status protected by applicable federal, state, or local law.

As a tribally owned organization, Quivera Enterprises and its subsidiaries may apply Indian Preference in accordance with applicable tribal, federal, and contractual requirements where authorized by law.