IT CYBERSECURITY SPECIALIST (INFOSEC)

US Warfighting Acquisition University; Huntsville (AL); On-site; USD 100,000 - 130,000; Full time

Job summary

US Warfighting Acquisition University seeks an Information Systems Security Officer (ISSM) to lead RMF lifecycle activities, support FedRAMP, and oversee continuous monitoring for DoD-acquired information systems. The role emphasizes risk management, policy development, and collaboration with stakeholders across acquisition and engineering teams.

The ideal candidate will bring experience in RMF artifacts, security control implementation, and cross-functional leadership to ensure mission-critical

Qualifications

• Attention to Detail: review IT-related work for accuracy and consistency with standards.
• Customer Service: maintain relationships with customers and identify IT products meeting needs.
• Oral Communication: brief management and IT staff on status and explain technical details to non-technical audiences.
• Problem Solving: identify alternatives by gathering information from multiple sources.

Responsibilities

• Supporting RMF lifecycle activities: categorization, control implementation, assessment prep, and continuous monitoring.
• Familiarity with FedRAMP authorization, continuous monitoring, cloud security control implementation, and secure configurations for federal clouds.
• Preparing, reviewing, and maintaining RMF artifacts: SSPs, control statements, SARs, POA&Ms, risk documentation, and monitoring records.
• Analyzing vulnerability scans, configuration data, audit findings, and system changes to identify risk and guide remediation.
• Understanding Zero Trust architecture initiatives across ICAM, device compliance, network segmentation, and data protection.

Skills

Attention to Detail

Customer Service

Oral Communication

Problem Solving

Job description

This position is under the DoW Acquisition Workforce Personnel Demonstration Project (AcqDemo) within Title 5 Competitive Service.For more information on Acq Demo please go to the DoW AcqDemo website at https://acqdemo.hci.mil/ and Fact Sheet at https://acqdemo.hci.mil/faq.html

Purpose of NH-3: Serves as an Information Systems Security Officer.
Purpose of NH-4: Serves as a senior ISSM and principal cybersecurity technical authority. All qualification and time-in-grade (if applicable) requirements must be met within 30 days of the closing date of this announcement.

You must meet the minimum qualification requirements as stated in the Office of Personnel Management (OPM) Operating Manual, Qualification Standards for General Schedule Positions, http://www.opm.gov/qualifications/Standards/group-stds/gs-prof.asp.

Basic Requirement: Applicants must have IT-related experience demonstrating the following competencies appropriate to, or above, the level of this position. For vacancies below the full-performance level of the position, the basic requirement will be evaluated on a developmental basis. Your resume and work experience should clearly support your ability to meet these competencies and will be evaluated as part of the entire application process.

• Attention to Detail- experience reviewing my own information technology-related work or data and have been asked by others to review their work or data to ensure accuracy, completeness, and consistency with standards.
• Customer Service- experience maintaining relationships with customers, assessing current information technology needs of customers, and developing or identifying information technology products and services that are tailored to meet customer needs.
• Oral Communication- briefing mid-level management and IT staff on the status of information technology systems, projects, or daily operations, including the communication of technical information to a non-technical audience.
• Problem Solving- identifying alternatives to address complex information technology-related issues by gathering and applying information from a variety of sources that provide a number of potential solutions.

In addition to meeting the basic requirement, you must have one year specialized experience.
NH-03: You must have one year of specialized experience at the next lover broadband NH-02, equivalent to the GS-11 grade level or equivalent in other pay systems. Specialized experience must demonstrate support for RMF program support for information systems, including:

• Supporting RMF lifecycle activities, including categorization, control selection, control implementation, assessment preparation, authorization package development, and continuous monitoring.
• Familiarity with FedRAMP authorization, continuous monitoring, cloud security control implementation, shared responsibility models, and secure configuration practices for federal cloud environments.
• Preparing, reviewing, and maintaining RMF artifacts, including System Security Plans, control implementation statements, Security Assessment Reports, POA&Ms, risk acceptance documentation, assessment artifacts, and continuous monitoring records.
• Analyzing vulnerability scan results, configuration compliance data, audit findings, system changes, and assessment results to identify risk, support remediation, validate closure evidence, and document compensating controls.
• Practical understanding of Zero Trust architecture initiatives across ICAM, device compliance, network segmentation, application security, data, protection, telemetry, and automation pillars.

NH-04: One year of specialized experience at the next lower broadband NH-03, equivalent to the GS-13 grade level or equivalent in other pay systems. Specialized experience must demonstrate leadership or advisory responsibility for RMF program execution for complex, high-visibility, or enterprise information systems, including:

• Preparing, reviewing, and approving organizational cybersecurity and RMF policies, directives, procedures, and instructions to ensure alignment with federal, DoD, and organizational security requirements.
• Leading RMF planning, authorization readiness, control implementation reviews, assessment coordination, continuous monitoring, POA&M governance, risk acceptance analysis, and development of risk recommendations for leadership.
• Reviewing and validating authorization packages, security control evidence, vulnerability remediation strategies, cloud security responsibilities, system interconnections, software assurance results, and major system changes to determine cybersecurity risk and mission impact.
• Advising system owners, program managers, technical teams, assessors, contractors, and leadership on RMF execution, documentation quality, control implementation, audit readiness, vulnerability prioritization, Zero Trust alignment, and secure system lifecycle requirements.
• Leading cross-functional coordination across acquisition, engineering, operations, security, and executive stakeholders to resolve cybersecurity risks, support authorization decisions, maintain continuous monitoring visibility, and align RMF activities with mission priorities.

PART-TIME OR UNPAID EXPERIENCE: Credit will be given for appropriate unpaid and or part-time work. You must clearly identify the duties and responsibilities in each position held and the total number of hours per week.

VOLUNTEER WORK EXPERIENCE: Refers to paid and unpaid experience, including volunteer work done through National Service Programs (i.e., Peace Corps, AmeriCorps) and other organizations (e.g., professional; philanthropic; religious; spiritual; community; student and social). Volunteer work helps build critical competencies, knowledge and skills that can provide valuable training and experience that translates directly to paid employment. You will receive credit for all qualifying experience, including volunteer experience.