Senior Cybersecurity Subject Matter Expert (SME)

Central Strategies, LLC; Washington, Northern (District of Columbia, KY); Hybrid; USD 140,000 - 190,000; Full time

Benefits offered by this job

Hybrid work with on-site classified

SIPRNet access may be required

Job summary

Central Strategies LLC seeks a Senior Cybersecurity Subject Matter Expert to support a federal cybersecurity program office. The role provides ISSE services, compliance, assessment, and reporting for federal systems and hybrid cyber-physical platforms.

The SME will advise government stakeholders on strategy, architecture, risk, and emerging technologies while leading RMF activities, SSPs, and POA&Ms. Hybrid work is required with on-site classified work and travel as needed.

Qualifications

• Bachelor’s degree in a related technical discipline; substitution not allowed.
• 8+ years of cybersecurity experience relevant to the role.
• Active CISSP plus CISSP-ISSEP or CISSP-ISSAP in good standing.
• Active SECRET clearance with ability to obtain CAC.
• RMF experience: categorization, control selection, assessment, authorization, continuous monitoring.

Responsibilities

• Serve as the designated ISSE for information systems and OT; lead RMF lifecycle from categorization to continuous monitoring.
• Develop RMF authorization packages in eMASS (SSPs, SCTMs, POA&Ms, reports, contingency and incident plans).
• Conduct Security Readiness Reviews; analyze ACAS/Nessus results; track remediation and DISA coordination.
• Maintain DoD/DHS/DISA STIG compliance; support cATO, automated evidence collection, dashboard integration.
• Perform Security Impact Assessments; participate in change boards and DHS reviews; support CONOPS meetings.
• Integrate Zero Trust, RMF controls, and OT/ICS security in system designs; perform risk assessments.
• Evaluate threats, OT/ICS vulnerabilities, and supply chain risks; recommend safeguards.
• Track directives and produce readiness metrics, executive briefings, and data call responses.
• Provide senior technical leadership and mentorship to ISSE team; drive continuous improvements.

Skills

Technical leadership

Written and verbal communication

Advising government stakeholders

Security program leadership

Education

Bachelor’s degree in Computer Science / Cybersecurity / IT / Software Engineering / Information Systems / Computer Engineering

Active CISSP and CISSP-ISSEP or CISSP-ISSAP

Tools

eMASS

ACAS/Nessus/Security Center

Elastic SIEM

HBSS

Tanium

Splunk

ServiceNow

Burp Suite

Job description

Central Strategies LLC is seeking a Senior Cybersecurity Subject Matter Expert (SME) to support a federal cybersecurity program office. This position provides Information System Security Engineer (ISSE) services and cybersecurity compliance, assessment, management, and reporting support for federal information systems, operational technology, and hybrid cyber-physical platforms. The SME advises government stakeholders on cybersecurity strategy, architecture, risk, mandates, emerging technologies, and industry best practices.

Key Responsibilities:

• Serve as the designated ISSE for assigned information systems and operational technology; lead the NIST SP 800-37 RMF lifecycle from categorization through continuous monitoring and decommissioning.
• Develop and maintain RMF authorization packages in eMASS, including SSPs, SCTMs, POA&Ms, assessment reports, contingency and incident response plans, risk assessments, inventories, topology diagrams, and data-flow diagrams.
• Conduct Security Readiness Reviews; analyze ACAS/Nessus results; and track remediation, patching, POA&Ms, false positives, and DISA coordination.
• Maintain continuous monitoring and compliance with DoD, DHS, USCG, and DISA STIG requirements; support cATO, automated evidence collection, and dashboard integration.
• Perform Security Impact Assessments and participate in change boards, DHS SELC reviews, acquisition milestones, CONOPS working groups, and technical exchange meetings.
• Integrate Zero Trust, RMF controls, and OT/ICS security requirements into system designs; perform security engineering analyses, trade studies, and architectural risk assessments.
• Evaluate emerging threats, adversary tactics, OT/ICS vulnerabilities, and supply-chain risks; recommend safeguards that reduce attack surface and improve resilience.
• Track cybersecurity directives and produce readiness metrics, executive briefings, risk memoranda, recurring reports, and responses to cybersecurity data calls.
• Provide senior technical leadership and mentorship to the ISSE team and recommend continuous improvements to government leadership.

Required Qualifications:

• Bachelor’s degree in Computer Science, Cybersecurity, Information Technology, Software Engineering, Information Systems, Computer Engineering, or a related technical discipline; experience may not substitute for the degree requirement.
• At least 8 years of cybersecurity experience relevant to this position.
• Active CISSP plus CISSP-ISSEP or CISSP-ISSAP, in good standing, before the start date.
• Active final SECRET clearance based on a Tier 3/SF-86 investigation; ability to obtain and maintain a Common Access Card.
• Demonstrated RMF experience, including categorization, control selection and implementation, assessment, authorization, and continuous monitoring.
• Strong knowledge of cybersecurity risk, laws and policy, threats and vulnerabilities, networking, protocols, network-security methods, and operational impacts.
• Exceptional written and oral communication skills with the ability to advise technical teams and government leadership.

Certification Requirements:

Mapped to DoD Cyber Workforce Framework work role 631 (ISSE), Advanced proficiency. The candidate must hold an active CISSP and either CISSP-ISSEP or CISSP-ISSAP before beginning performance. Associate of ISC2 status and certifications in progress do not qualify.

Desired Qualifications:

• Experience with eMASS, ACAS/Nessus/Security Center, Elastic SIEM, HBSS, Tanium, Splunk, ServiceNow, or Burp Suite.
• Experience securing OT/ICS/SCADA, shipboard, aviation, or other cyber-physical platforms, including the DoD Assess Only process.
• Familiarity with DHS 4300A, USCG cybersecurity policy, DoDAF artifacts, ITIL/DESMF practices, and DevSecOps pipelines.
• Prior USCG, DHS, or DoD RMF support experience.

Work Environment and Additional Requirements

• Hybrid work with on-site reporting for classified work, SIPRNet access, required meetings, training, and onboarding or offboarding activities.
• SIPRNet access may be required; eligibility includes a final SECRET clearance and any required security briefing or read-on.
• Occasional COR-approved CONUS travel may include other government facilities, vessels, aircraft, Alaska, Hawaii, or U.S. territories.