IT Risk Assessment Auditor -Special Programs

MIT Lincoln Laboratory; Lexington (MA); Hybride; USD 115 000 - 152 000; Plein temps

Avantages offerts par ce poste

Health benefits

Pension / 401K

Paid leave

Tuition reimbursement

Résumé du poste

MIT Lincoln Laboratory’s Security Department identifies and counters risks to national security through independent cybersecurity assessments of classified systems. You will review SSPs, security plans, and STIGs, ensuring compliance with RMF, JSIG, ICD-503, and NIST guidance.

You will communicate findings to system stakeholders, coordinate with owners, and support planning and readiness activities for new systems and reauthorizations.

Qualifications

• Bachelor's degree preferred in CS/IT or related field.
• Candidate must meet DoD security clearance requirements and RMF familiarity.
• Experience with RMF, JSIG, ICD-503 and STIGs is highly desired.
• Experience in compliance auditing and vulnerability assessments is required.
• Excellent written and verbal communication skills are required.

Responsabilités

• Conduct independent cybersecurity compliance assessments of classified systems.
• Evaluate security controls via SSPs, docs, configurations, and interviews.
• Assess compliance with NIST SP 800-53, JSIG, ICD-503 and STIGs.
• Review system security documentation and continuous monitoring evidence.
• Identify gaps, risks, and provide actionable remediation findings.
• Communicate results to stakeholders through reports and briefings.
• Coordinate with system owners to validate evidence and findings.
• Support planning, scope development, and government inspection readiness.
• Monitor changes to security requirements to keep practices current.

Connaissances

RMF knowledge

NIST SP 800-53

JSIG

Security audits

Communication skills

Vulnerability assessment

Formation

Bachelor's degree in CS/IT or related field

Top Secret clearance eligibility

DoD 8570 IAM baseline cert (e.g. Security+)

Outils

STIGs

System virtualization

Windows/Linux/UNIX

Description du poste

The Security Department’s overall mission is to identify and counter security threats to the MIT Lincoln Laboratory’s mission of development of game-changing technology in support of National Security, including guarding against compromise by foreign intelligence agencies and insider threats. To accomplish this mission, this department formulates and implements policies, plans, and actions designed to protect facilities against threats of vandalism, accidental destruction, and sabotage; and safeguards personnel, classified and unclassified information systems, personal identifiable information, property, and other assets from exploitation and recruitment by foreign intelligence agencies.

We foster a culture where security professionals are empowered to solve complex security problems in close collaboration with Laboratory research teams and Government counterparts. Our people are our most important resource, and we encourage a casual and flexible opportunity-filled working environment that is technology-focused. Where mission needs can be met, the Security Department encourages flexible schedules and hybrid remote work arrangements.

Who are we?

MIT Lincoln Laboratory (MIT LL) is a Federally Funded Research and Development Center (FFRDC) whose mission is research in support of National Security.

• Mission - The Security Department’s (SD) overall mission is to identify and counter security threats to the MIT LL’s mission of development of game-changing technology in support of national security, including guarding against compromise by foreign intelligence agencies and insider threats.
• Culture – We foster an inclusive, opportunity-filled environment of empowered team members from diverse backgrounds.

What will you do?

Conduct independent cybersecurity compliance assessments of classified systems, networks, and supporting environments against applicable government and organizational security requirements.

• Evaluate security control implementation and effectiveness through review of system security plans, supporting documentation, technical configurations, assessment evidence, and interviews with system personnel.
• Assess compliance with applicable standards and requirements, including NIST SP 800-53, NIST SP 800-53A, JSIG, ICD 503, and DISA Security Technical Implementation Guides (STIGs).
• Perform technical and administrative reviews of system security documentation, including SSPs, security procedures, configuration management documentation, and continuous monitoring evidence.
• Evaluate technical security practices and supporting evidence related to vulnerability management, system hardening, audit logging, access control, configuration management, and other applicable cybersecurity controls.
• Identify compliance gaps, security weaknesses, and potential risks. Develop clear, objective, evidence-based findings and practical recommendations for corrective action.
• Communicate assessment results and security risks to system stakeholders, ISSMs, ISSOs, program personnel, and leadership through written reports, briefings, and assessment out-briefs.
• Coordinate with system owners and security personnel to clarify requirements, validate assessment evidence, resolve factual discrepancies, and ensure findings accurately reflect observed conditions.
• Support assessment planning, scope development, recurring compliance reviews, government inspection readiness activities, and assessments of new systems and systems undergoing authorization renewals.
• Monitor applicable changes to cybersecurity requirements, assessment guidance, and technical security standards to support consistent and current assessment practices.

How will you grow?

You will find significant opportunities to do meaningful work in an environment intentionally designed to be one where you will learn, thrive and belong.

• Leadership: Room to advance on your team or to lead cross-functional projects.
• Growth Opportunities: Potential for lateral and vertical movement.
• Education/Training: Management training, mentorship, in-house and external courses.
• Exposure: Engagement with sponsors, stakeholders, Laboratory leadership and other Departments and Divisions.
• Community: Participation is encouraged for Laboratory social events, Employee Resource Groups (ERGs), clubs and study groups, volunteering and community service projects.

What you need/Requiremetns:

For this position, you must meet these basic requirements:

• Selected candidate will be subject to a pre-employmentbackground investigation and mustpossessandmaintain a current in scope Top Secret level DoD securityclearance
• Selected candidate will be subject to a pre-employment backgroundinvestigation and must be able to obtain andmaintainaTopSecretlevel DoD security clearance with SensitiveCompartmentedInformation (SCI) eligibility
• Must be a U.S. Citizen.
• Successfully pass a background check and must meet all eligibility requirements for access to classified information.
• Bachelor’s degree in Computer Science, Information Technology, Computer Information Systems, or related field is preferred.
• Possess a DoD 8570.01-M IAM I baseline certification (e.g. CompTIA Security+)
• Information Assurance Certifications preferred (CISSP, CISA, CISM,).
• Additional desired certifications (CCNP – Cisco, CASP CE+, Pentest+)
• Technical experience, skills, and course work completed towards an Undergraduate Degree, or industry IT certifications may be considered in lieu of education or DoD security experience requirements
• Experience in compliance auditing, security reviews, or vulnerability assessments.
• Candidate must possess an in-depth knowledge of information security principles and policies such as Risk Management Framework (RMF) as presented by the National Institute of Standards and Technology (NIST), Joint Special Access Program (SAP) Implementation Guide (JSIG), Intelligence Community Directive 503 (ICD-503), and all applicable Security Technical Implementation Guides (STIGs).
• Experience and familiarity with multiple operating systems such as Windows Server, Windows 11, Red Hat Enterprise Linux, Ubuntu, Mac, etc.
• Experience with virtualization technologies is preferred.
• Technical experience securing networks and systems utilizing DISA Security Technical Implementation Guides (STIGs) and/or SRGs is highly desired.
• Excellent written and verbal communication skills are required.

Ideally, you will have:

The Laboratory values experiences from diverse backgrounds and occupations. The most successful candidates will have the following skills and qualifications.

• Strong interpersonal skills and be able to manage stress in a professional manner.
• Knowledgeable in computer security principles and policies, to include the RMF, STIGs, JSIG, and ICD 503.
• Strong technical skills and ability to respond to off-hours emergencies.
• Position requires occasional local and overnight travel.

Hiring Range: $114,600 - $151,900

Disclaimer: MIT Lincoln Laboratory provides a typical hiring range as a good faith estimate of what we reasonably expect to offer for this position at the time of posting. The final salary offered to a selected candidate will depend on various factors, including—and not limited to—the scope and responsibilities of the role, the candidate’s experience, skills and education/training, internal equity considerations and applicable legal requirements. This range reflects base salary only and does not include additional forms of compensation or benefits.

At MIT Lincoln Laboratory, our exceptional career opportunities include many outstanding benefits to help you stay healthy, feel supported, and enjoy a fulfilling work-life balance. Benefits offered to employees include:

• Comprehensive health, dental, and vision plans
• MIT-funded pension
• Matching 401K
• Paid leave (including vacation, sick, parental, military, etc.)
• Tuition reimbursement and continuing education programs

Selected candidate will be subject to a pre-employment background investigation and must be able to obtain and maintain a Secret level DoD security clearance.

MIT Lincoln Laboratory is an Equal Employment Opportunity (EEO) employer. All qualified applicants will receive consideration for employment and will not be discriminated against on the basis of race, color, religion, sex, sexual orientation, gender identity, national origin, age, veteran status, disability status, or genetic information; U.S. citizenship is required.