Security Compliance SME

Creative G C; Herndon (VA); Hybrid; USD 90,000 - 130,000; Full time

Job summary

Creative G C seeks a Security Compliance SME to obtain ATO/ATO in a DISA IL5 enclave. You will manage eMASS, coordinate 3PAOs, and drive SSP/POA&M artifacts. Remote-friendly with VA on-site requirements, you will guide vulnerability scans and risk-based decisions for federal security programs.

Required 5+ years leading FedRAMP/FISMA activities, strong technical writing, and ability to coordinate with assessors to sustain authorization lifecycle.

Qualifications

• 5+ yrs leading A&A for a FedRAMP or FISMA Moderate system through authorization and continuous monitoring
• Direct 3PAO coordination for significant FedRAMP changes (SAP scoping, evidence packages, test support, SAR adjudication)
• Authorship of SSP control statements against NIST SP 800-53 Rev 5 Moderate baseline
• Security impact analysis, risk-based AO recommendations, change type determinations
• POA&M management, deviation requests, and monthly ConMon reporting
• UiPath familiarity to describe bot behavior, credentials, and data flows in control terms
• Strong technical writing for AO and assessor communications

Responsibilities

• Attain an Authority to Connect and an Authority to Operate in a DISA IL5 enclave
• Maintain and update the eMASS profile and run daily vulnerability scans
• Develop and draft System Security Plan, System Assessment Plan, and related artifacts
• Prepare Plan of Action & Milestones, Contingency and Incident Response plans
• Oversee Configuration Management and System and Communications Protection artifacts

Skills

FedRAMP A&A

NIST SP 800-53 Rev 5

AO risk analysis

eMASS management

ACAS vulnerability scans

3PAO coordination

Technical writing

UiPath basics

Tools

eMASS

ACAS

UiPath

Job description

Job Description:

Title: Security Compliance SME

Location: Remote (Herndon, VA)

Duration: 12 Months Contract

Clearance:

Able to obtain MBI Clearance

Note: Local to VA will have to go for 4 days on-site and 1 day remote; No West Coast

Job Summary:

As a Security Compliance SME, you are responsible for attaining an Authority to Connect and an Authority to Operate in a DISA Impact Level 5 security enclave. Duties include eMASS entrees and management of the eMASS profile. You will also manage the ACAS platform and run daily vulnerability scans. You will assist in the development of the System Security Plan, System Assessment Plan, Security Assessment Plan, Plan of Action & Milestones, Contingency Plan, Incident Response Plan, Configuration Management Plan, and System and Communications Protection artifacts.

Required Skills:

• 5+ yrs leading A&A for a FedRAMP or FISMA Moderate system through authorization and continuous monitoring
• Demonstrated ownership of a FedRAMP significant change request, including direct 3PAO coordination (SAP scoping, evidence packages, test support, SAR adjudication)
• Expert authorship of SSP control implementation statements against the NIST SP 800-53 Rev 5 Moderate baseline.
• Security impact analysis, change type determination, and risk-based recommendations to an AO.
• POA&M management, deviation requests, and monthly ConMon reporting.
• Working knowledge of UiPath is sufficient to describe bot behavior, credentials, and data flows in control terms.
• Technical writing for AOs and assessors.