Security Auditor (Expert)

Pueo Business Solutions LLC; McLean (VA); Presencial; USD 148.000 - 168.000; Jornada completa

Descripción de la vacante

Pueo seeks an experienced Security Auditor to join our multidisciplinary team onsite in McLean, VA. You will regularly interface with IC agency and DoD leadership to support JWICS connections and risk assessments.

The role requires hands-on RMF/A&A work, knowledge of STIGs, NIST RMF, and experience with scanning/GRC tools. Strong communication with CIO and stakeholders is essential.

A TS/SCI with CI poly and related degree with extensive experience is expected for this position.

Formación

• Active TS/SCI with CI poly; ability to obtain/maintain.
• Bachelor’s degree and 12+ years experience, or 16+ years without degree.
• IAT III certification per DoD 8570.01-M (e.g., CISSP, CASP+).
• Experience in SSP/SAR/POA&M/ATO ownership; NIST RMF fluency.
• Hands-on RMF/A&A experience relevant to Security Auditor.
• Familiarity with IC and DoD cybersecurity policies and STIGs.
• Ability to draft SOPs and manage ATC/CONMON/POA&M activities.
• Experience with scanning/GRC tools.

Responsabilidades

• Lead ATC activities assessing JWICS customer connections.
• Prepare formal reports, briefs, and connection packages.
• Coordinate with CIO entities and stakeholders to meet requirements.
• Analyze ATC data to improve CONMON and POA&M processes.
• Draft cyber-profile assessments communicating connection risk.
• Collaborate with ATC stakeholders on risk communication.
• Plan, execute, and report ATC assessments with subscribers.
• Assist in preparing assessment deliverables (ATC docs, risk assessments).
• Present risk findings verbally and in writing.

Conocimientos

RMF/A&A experience

DoD IC policies

Cybersecurity concepts

SOP drafting

Communication skills

ATC knowledge

Vulnerability assessment

GRC tools

Stakeholder engagement

Educación

Bachelor's degree in related field

Herramientas

XACTA

eMASS

ACAS

STIGs

Descripción del empleo

Description

Pueo is seeking an experienced Security Auditor to join our unique team of multidisciplined experts onsite in McLean, VA. In this role you will regularly interface with all IC agency and DoD leadership.

The ideal candidate should possess hands‑on Risk Management Framework (RMF) / Assessment & Authorization (A&A) work experience relevant to the Security Auditor as well as experience with scanning/GRC tools.

In this role you will be assisting the Defense Intelligence Agency (DIA) Chief Information Office (CIO), JWICS Program Division (CIO6) in the management and execution of the JWICS Connection Approval Program.

The Security Auditor will be responsible for the following, but not limited to:

• Provide expertise in conducting Approval to Connect (ATC) activities requiring both technical and non-technical skills in assessing DIA JWICS customers’ request to connect their node to JWICS. ATC requires an understanding of DoD and IC Cybersecurity Polices, Regulations, Security Technical Security Implementation Guides (STIGs), and NIST RMF.
• Responsible for documentation and generating formal reports, briefs, circuit connection packages, that are used to assist organizations to acquire Approval To Connect while minimizing risk to JWICS.
• Interact with CIO entities, subscribers, and other stakeholders to ensure all subscriber connections meet the foundational requirements for compliance. These assessments are conducted in the broader context of the subscriber’s architecture and consider AO risk decisions.
• Evaluate and assess ATC data to highlight strategic efficiencies or tactical cyber-signatures. This will be used to provide recommendations focused on the maturity of ATCs CONMON, ATC, and POAM management processes to minimize risks to JWICS.
• Draft, coordinate, and collaborate on the development of technical documentation or cyber-profile assessments that communicate a connections risk to the JWICS enterprise.
• Collaborate with ATC stakeholders to ensure a connections cyber-security risks are communicated and clearly understood.
• Participate in the planning, execution, and reporting of ATC assessments and collaborating with subscribers to ensure vulnerability assessments are integrated with minimal supervision.
• Assist in preparation and organization of assessment deliverables – ATC foundational documents, Security Risk Assessments, and other compliance data.
• Communicate the impact of system risks and vulnerabilities verbally, through presentations and written deliverables.

Requirements

• Must have a current/active TS/SCI with the ability to obtain and maintain a CI Poly.
• Bachelor’s Degree in related field and 12 years of experience, or additional 4 years of experience in lieu of a completed degree for a total of 16+ years.
• Must possess one of the following IAT III Certification in compliance with DoD 8570.01-M and DoD Directive 8140 Cyberspace Workforce Management. (ex; CASP+ CE, CCNP Security, CISA, CISSP (or Associate), GCED, GCIH, CCSP).
• Experience in SSP/SAR/POA&M/ATO ownership; NIST 800-series fluency.
• Hands‑on RMF / A&A experience relevant to Security Auditor.
• Experience in Intelligence Community (IC) security policies, specifically an understanding of DoD and IC Cybersecurity Polices, Regulations, Security Technical Security Implementation Guides (STIGs), and NIST RMF.
• Familiarity with a variety of cybersecurity concepts, practices, and procedures.
• Ability to draft, coordinate, and finalize Standard Operating procedures, business process and workflow design, and manage their execution to consistently apply ATC, CONMON, and POA&M management activities.
• Experience with scanning/GRC tools.

Desired Qualifications

• An active Top Secret security clearance with SCI eligibility and current CI poly.
• DIA ATC experience.
• Experience in scanning/GRC tools such as XACTA/eMASS, ACAS, STIGs; triage and remediation vs. risk acceptance.
• Strong independent work ethic (auditor mentality), exceptional oral and written communication skills, and the ability to work unsupervised.
• Solid interpersonal and communication skills to interact with various stakeholders and team members effectively.

Salary Range Estimate

Min $147,742– Max $167,888. The estimate displayed represents the typical salary range for this position and is just one component of Pueo’s total compensation package for employees. Other rewards may include annual bonuses, short- and long-term incentives, and program-specific awards. In addition, Pueo provides a variety of benefits to employees.

Pueo Overview

Pueo is a National Security cyber company built to inspect, defend, harden, and continuously authorize the networks our customers depend on. We deliver mission-grade cybersecurity across defense, intelligence, homeland security, federal enterprise, and critical infrastructure. Our work connects mission-risk inspection, defensive cyber operations, continuous authorization, security engineering, and mission delivery through one accountable team.

Pueo EEO Statement

Pueo is an equal employment opportunity employer and affirmative action employer. All interested individuals will receive consideration and will not be discriminated against on the basis of race, color, religion, sex, national origin, disability, age, sexual orientation, gender identity, genetic information, or protected veteran status. Pueo takes affirmative action in support of its policy to advance diversity and inclusion of individuals who are minorities, women, protected veterans, and individuals with disabilities.