Lead Information Assurance Security Specialist

ASRC Federal; Fort Meade, Northern (MD, KY); Hybrid; USD 140,000 - 190,000; Full time

Job summary

ASRC Federal seeks a Lead Information Assurance Security Specialist to lead RMF implementation for the DISA JPES/JCRM program at Fort Meade. The role oversees ATO sustainment, vulnerability remediation, and secure DevSecOps integration across multi-enclave environments, including Azure IL6 and SIPR.

The senior position requires a Secret clearance, DoD experience, and collaboration with government cybersecurity personnel to maintain a robust security posture while enabling agile delivery.

Qualifications

• Bachelor’s degree required; four years of additional experience may substitute a degree.
• At least 10 years of Information Assurance, RMF, or cybersecurity experience in DoD environments.
• Direct RMF, eMASS, ATO sustainment, STIG validation, vulnerability management, and POA&M remediation experience.
• Experience securing containerized apps and Kubernetes environments.
• Experience with Azure IL6, SIPR, or comparable classified DoD-hosted environments.
• Security+ or DoD 8140 qualification; CISSP preferred.
• Active Secret clearance at hire.

Responsibilities

• Lead RMF lifecycle activities and maintain artifacts in eMASS.
• Support ATO authorization and continuous monitoring activities.
• Implement and validate STIGs for RHEL, Kubernetes, Tomcat, PostgreSQL, and web components.
• Direct ACAS/Nessus vulnerability scanning and analysis.
• Coordinate application security testing with Fortify or equivalent SAST/DAST.
• Manage POA&M development, remediation, and evidence.
• Translate findings into prioritized Agile backlog and sprint work.
• Advise on security patterns for Azure IL6, Kubernetes, and multi-enclave deployments.
• Provide security metrics and status updates to leadership.

Skills

RMF

eMASS

Vulnerability management

DevSecOps

SAST/DAST

Education

Bachelor’s degree in engineering, cybersecurity, computer science, information technology

Tools

Fortify

ACAS/Nessus

eMASS

Job description

ASRC Federal is seeking a Lead Information Assurance Security Specialist.

This is a contingent position supporting ASRC Federal’s pursuit of the Defense Information Systems Agency Joint Planning and Execution Services and Joint Capabilities Requirements Manager Sustainment Services program.

JPES/JCRM supports mission-critical Global Force Management planning, execution coordination, operational data management, and interoperability for globally distributed Department of Defense users and command organizations. The program encompasses Agile software sustainment and enhancement, secure cloud and platform operations, system integration, testing and release management, cybersecurity compliance, and operational mission support.

The technical environment includes classified SIPR and Azure IL6 enclaves, Kubernetes, Red Hat Enterprise Linux, Java/Spring, React, PostgreSQL EDB, transitional Oracle integration, REST APIs, ELK observability, and DevSecOps pipelines integrated with DISA’s C2FS/C2SF environment. The work requires close collaboration with DISA program, engineering, product, security, and operational-user stakeholders.

This is a full-time position located onsite at Fort Meade, Maryland. The position requires U.S. citizenship, an active Secret security clearance, and less than 10% travel. Employment is contingent upon contract award and Government approval of key personnel.

Job Description

The Lead Information Assurance Security Specialist will serve as the senior cybersecurity and mission-assurance authority for the DISA JPES/JCRM program. The position will lead implementation and sustainment of the Risk Management Framework across classified, containerized, cloud-hosted, and multi-enclave environments.

The Lead IA Specialist will maintain the program’s security posture, direct RMF and eMASS activities, support ATO sustainment, manage vulnerability and POA&M remediation, and ensure security requirements are integrated into Agile development and DevSecOps delivery. The position will work closely with application, platform, database, integration, and Government cybersecurity personnel to implement security by design without disrupting operational delivery.

Primary Responsibilities

• Lead RMF lifecycle activities and maintain required artifacts in eMASS.
• Support initial and ongoing ATO authorization and continuous-monitoring activities.
• Implement, assess, and validate STIGs for RHEL, Kubernetes, Tomcat, PostgreSQL, and web-application components.
• Direct ACAS/Nessus vulnerability scanning and analysis.
• Coordinate application-security testing using tools such as Fortify or equivalent SAST/DAST capabilities.
• Manage POA&M development, remediation, closure evidence, and risk-acceptance coordination.
• Translate cybersecurity findings into prioritized Agile backlog and sprint-remediation activities.
• Support security architecture for REST APIs, data exchange, DevSecOps pipelines, and external DoD interfaces.
• Coordinate IAVM compliance, patching, configuration validation, audit support, and security-control evidence.
• Advise technical teams on secure implementation patterns for Azure IL6, Kubernetes, databases, and multi-enclave deployments.
• Provide security status, risks, metrics, and recommendations to program and Government leadership.

Minimum Qualifications

• Bachelor’s degree in engineering, cybersecurity, computer science, information technology, or a related discipline; four additional years of experience may be accepted in lieu of a degree.
• At least 10 years of Information Assurance, RMF, or cybersecurity experience in DoD environments.
• Direct experience with RMF, eMASS, ATO sustainment, STIG validation, vulnerability management, and POA&M remediation.
• Experience securing containerized applications and Kubernetes environments.
• Experience integrating cybersecurity controls and scanning into DevSecOps delivery.
• Experience with Azure IL6, SIPR, or comparable classified DoD-hosted environments.
• Security+ or other applicable DoD 8140 qualification required.
• CISSP preferred.
• Active Secret clearance required at time of hire.