SECURITY & RISK ENGINEER (SRE)

Hiring Our Heroes; Arlington (VA); On-site; USD 120,000 - 180,000; Full time

Job summary

Zermount Inc. seeks an experienced System Risk Engineer to support risk analysis and ensure federal information systems meet cybersecurity standards. The role involves validating controls across cloud, on‑premise, and network environments, producing risk memos, and guiding remediation with a focus on mission assurance.

Ideal candidates have 7+ years in cybersecurity for U.S. Government systems and hands-on RMF/GRC experience, with active security focus and strong collaboration with engineering

Qualifications

• 7+ years of cybersecurity experience supporting U.S. Government systems.
• 4+ years performing RMF, ISSO, Assessment, or GRC functions with technical validation.
• Hands-on experience in two technical domains (cloud, network, systems, or databases).
• Ability to validate controls using configurations, logs, and interviews

Responsibilities

• Execute Security Assessments, Risk Assessments, and Ongoing Authorization in live environments.
• Validate security controls across OS, applications, databases, cloud, and networks.
• Identify real-world risks, including exploitable vulnerabilities and misconfigurations.
• Perform continuous risk analysis using scans, tests, logs, and configs.
• Develop risk-based findings and POA&M matrices with remediation prioritization.
• Produce SARs, risk memos, and ATO packages with evidence-backed findings.
• Provide weekly status updates with risks and mitigation progress.

Skills

Security Assessment

Risk Validation

RMF 800-37/800-53

GRC

Zero Trust

DHS/FISMA

Cloud Security

Education

Bachelor's degree in CS/IT/Cybersecurity

Security certifications (CAP/CISA/CISM/CISSP)

Tools

Tenable

Qualys

CrowdStrike

Splunk

Microsoft Sentinel

IBM QRadar

Ansible

Terraform

Puppet

Archer

ServiceNow

Job description

Position Overview

Zermount Inc. is seeking a System Risk Engineer (SRE) to support system risk analysis and ensure that federal information systems comply with Information Assurance and cybersecurity standards. The SRE exists to ensure organizational systems are secure, resilient, and defensible in real‑world operating conditions, not simply compliant with security documentation. This role directly contributes to mission assurance by identifying, validating, and reducing cybersecurity risk through direct technical assessment, control validation, and risk‑based decision support across enterprise environments.

Duties & Responsibilities

• Execute Security Assessments (SA), Risk Assessments (RA), and Ongoing Authorization (OA) activities by validating security controls in live environments, not solely through documentation review
• Conduct technical verification and validation of security controls across operating systems, applications, databases, cloud platforms, and network infrastructure
• Identify real‑world security risks, including exploitable vulnerabilities, misconfigurations, weak trust boundaries, and control failures
• Perform continuous risk analysis using outputs from vulnerability scans, penetration testing, logging platforms, and configuration assessments
• Develop risk‑based findings and POA&M matrices, prioritizing remediation based on exploitability, exposure, and mission impact
• Produce executive‑quality artifacts (SARs, risk memos, ATO packages, executive briefings) with validated, evidence‑backed findings
• Conduct impact analysis for Requests for Change (RFCs), identifying security implications of architectural, configuration, or system modifications
• Validate Zero Trust implementation and alignment across system architectures and capabilities
• Perform technical assessments of system architecture, data flows, and trust boundaries to identify control gaps
• Conduct compliance validation for TIC, FISMA, and federal cybersecurity mandates through technical inspection and testing
• Ensure all deliverables meet accuracy standards with zero rework required and are aligned to program and client expectations
• Provide weekly status reporting and briefings with clear articulation of risks, risk mitigation progress, and technical findings

SME Area #1 – Primary Expertise: Security Assessment & Technical Risk Validation

• Deep knowledge of NIST RMF (800‑37, 800‑53, etc.), FISMA, EO 14028, OMB directives, FIPS 199/200, TIC, Zero Trust principles (CISA ZT, MM, NIST 800‑207, etc.)
• Ability to independently conduct Security Control Assessments (SCA), Risk Assessments (RA), and ATO/OA activities
• Capability to validate controls using system configurations, logs and telemetry, vulnerability scans, and system interviews and demos
• Ability to identify real‑world attack vectors and control failures, and develop actionable remediation actions that system teams can use to remediate findings

Required Tools Experience

• Vulnerability scanning tools such as Tenable, Qualys, CrowdStrike, etc.
• Log analysis platforms such as Splunk, Microsoft Sentinel, IBM QRadar, etc.
• Configuration and system inspection tools such as Ansible, Terraform, Puppet, etc.
• GRC platforms such as Archer, ServiceNow, etc.

SME Area #2 – Secondary Expertise: Multi‑Domain Technical Depth

• Cloud: AWS/Azure (IAM, logging, network security, misconfigurations)
• Network: Segmentation, firewalls, boundary protections, Zero Trust enforcement points
• Systems: Windows/Linux hardening, identity systems (AD, MFA)
• Databases/Data: Access control, encryption, auditing

Qualifications

Minimum Requirements

• 7+ years of cybersecurity experience supporting U.S. Government systems
• 4+ years performing RMF, ISSO, Assessment, or GRC functions with direct technical validation responsibilities
• Hands‑on experience in at least two technical domains (cloud, network, systems, or databases)
• Proven ability to analyze system configurations, ATOs, logs/telemetry, architecture documentation, and data flow diagrams
• Proven ability to conduct technical assessments across multiple domains

Preferred Qualifications

• Experience with Zero Trust assessments and implementation validation
• Experience with CDM, ISCM, and enterprise logging programs
• Experience supporting DHS/FISMA environments
• Familiarity with threat‑informed defense and attack vector analysis

Competency

• Advanced technical risk analysis and prioritization
• Independent problem‑solving in ambiguous environments
• Strong collaboration with system teams and federal leads
• Ability to translate complex technical findings into actionable recommendations
• Clear communication with both engineers and leadership

Education & Certifications

• Bachelor of Science (B.S.) in Computer Science, IT, Cybersecurity, or related field, plus minimum of 7 years of IT cybersecurity experience (including direct support for the U.S. Government) and 4 years in an ISSO, Assessor, Compliance, RMF, or GRC role with a technical validation focus
• Without a B.S. in a relevant field: Minimum of 13 years of IT cybersecurity experience (including direct support for the U.S. Government) and 4 years in an ISSO, Assessor, Compliance, RMF, or GRC role with a technical validation focus
• At least one of the following security certifications is required: CAP, CISA, CISM, CISSP, CCISO, CGRC, or an approved alternative

Clearance Level

Minimum of active Secret Clearance and ability to obtain and maintain DHS suitability.

Work Location

• Position is primarily remote – Continental U.S. only
• Primary on‑site location: Arlington, VA, and Springfield, VA
• Must be willing to travel – not to exceed 10% of the time

Hours of Operation

• 8:00 am EST – 4:30 pm EST (times may fluctuate based on client and business requirements)

Reporting Structure

• Reports To: Security Risk Engineering Team Lead
• Direct Reports: N/A