Senior Principal Cyber Information Systems Security Engineer

Saic; Norfolk (VA); On-site; USD 160,000 - 200,000; Full time

Job summary

SAIC is seeking an expert-level Senior Principal ISSE to lead RMF development and authorization for DoD enterprise IT systems. You will drive RMF lifecycle activities, coordinate with program leadership, and ensure ATO across unclassified and classified environments.

Travel up to 10% for site visits and engagement. The ideal candidate has extensive RMF, eMASS, and Navy/DoD authorization experience, with the ability to mentor junior staff and contribute to security policy and continuous

Qualifications

• Bachelor's degree and 14+ years of related experience; Master's degree and 12+ years; PhD/JD and 9+ years.
• 10+ years of hands-on ISSE and RMF experience across DoD programs.

Responsibilities

• Lead RMF development and authorization for unclassified and classified environments.
• Drive RMF lifecycle activities per NIST 800-37/800-53 across multiple systems.
• Manage eMASS records, POA&Ms, and authorization documentation.
• Coordinate with AOs, ISOs, and PMs to achieve Authority to Operate.
• Ensure continuous monitoring and ATO compliance across systems.
• Provide guidance to junior team members on RMF processes.
• Support business development with technical proposals and demonstrations.

Skills

RMF lifecycle management

eMASS system management

ATO package development

DoD RMF processes

NIST guidance familiarity

Continuous monitoring

Policy guidance

Mentoring junior staff

Education

Bachelor's degree

Master's degree

PhD or JD

Job description

Description

SAIC is seeking an expert-level Senior Principal Information Systems Security Engineer (ISSE) to support DoD enterprise IT and network modernization programs in one of the following locations and is required to be local: the National Capital Region, San Diego, CA, Norfolk, VA, or Charleston, SC.

This role serves as a senior principal individual contributor and subject matter expert responsible for leading the development, management, and authorization of Risk Management Framework (RMF) packages across both unclassified and classified environments in direct support of DoD enterprise IT and digital transformation missions.

The ideal candidate is a recognized expert in DoD RMF processes with deep hands‑on experience navigating Navy program office authorization workflows, eMASS system management, and ATO package development. This position requires direct engagement with senior government leadership, program offices, engineering teams, and authorizing officials to drive security authorization packages through the full RMF lifecycle from initiation through authorization and continuous monitoring.

This role operates with significant independence, serving as the senior principal ISSE authority and organizational spokesperson on complex cybersecurity authorization matters requiring coordination across multiple program teams, engineering organizations, and government stakeholders. The successful candidate will be a technically fluent self‑starter capable of leading RMF authorization efforts across simultaneous unclassified and classified programs while working collaboratively with a team of engineers to deliver compliant, authorized, and operationally ready systems in support of the warfighter.

Must be able to travel up to 10% to support program site visits and customer engagement

JOB DUTIES:

• Serve as Senior Principal ISSE and subject matter expert responsible for leading development, management, and authorization of RMF packages across both unclassified and classified environments supporting DoD enterprise IT and network modernization programs
• Lead end-to-end RMF lifecycle activities following NIST 800-39, 800-37, 800-53, 800-53A, and 800-137 for multiple simultaneous unclassified and classified systems
• Categorize systems and information stored and processed on systems based on FIPS 199 and NIST 800-60; select and tailor initial security control baselines based on FIPS 200 and NIST 800-53
• Implement security controls based on NIST Special Publication guidance documents including 800-34, 800-64, and 800-128; specifically and functionally document all implemented security controls
• Assess security controls based on NIST 800-53A to ensure they are implemented correctly, operating as intended, and producing desired outcomes
• Manage and maintain eMASS records for all assigned systems; ensure accuracy and completeness of all RMF artifacts, POA&Ms, and authorization documentation throughout the system lifecycle
• Drive RMF packages through full authorization workflow in accordance with Navy and DoD RMF processes; coordinate directly with Authorizing Officials (AOs), Information System Owners (ISOs), and Program Managers to achieve and maintain Authority to Operate (ATO)
• Ensure continuous monitoring is achieved based on NIST 800-137, 800-37, 800-53A, and related special publications; maintain ongoing ATO compliance across authorized systems
• Work collaboratively with teams of engineers to identify, document, and implement security controls across complex DoD enterprise IT and network infrastructure environments
• Perform internal auditing functions in support of ISO/IEC standards including 9000, 20000, and 27001; coordinate with external auditors to ensure actions have been performed to industry standards
• Perform policy analysis activities to author or support the authoring of new enterprise cybersecurity policy in alignment with DoD and Navy security requirements
• Provide expert technical guidance and mentorship to junior cybersecurity team members on RMF processes, eMASS management, and ATO authorization workflows
• Serve as organizational spokesperson and prime ISSE technical contact on significant cybersecurity authorization matters requiring coordination between program teams, engineering organizations, and government stakeholders
• Support business development activities including technical proposal development, capability demonstrations, and customer relationship management in support of program re-compete and growth opportunities

Qualifications

REQUIREMENTS:

Education and experience:

• Education: Bachelor's degree and 14+ years of related experience; Master's degree and 12+ years of related experience; PhD or JD and 9+ years of related experience
• Experience: 10+ years of hands‑on ISSE and RMF experience with demonstrated senior principal-level contributions across complex DoD program authorization environments

Clearance:

• Must be a U.S. Citizen
• Must have an Active Secret Clearance at start
• Must be able to obtain a TS/SCI after start

Certifications:

• DoD 8570/8140 IAM Level III or IAT Level III certification required (CISSP, CISM, or equivalent)
• CompTIA Security+ CE required at minimum

Technical Expertise:

• RMF lifecycle management (NIST 800-37, 800-53, 800-53A, 800-137)
• eMASS system management and ATO package development
• FIPS 199/200 system categorization and security control selection
• POA&M development, tracking, and remediation management
• Unclassified and classified system authorization workflows
• DoD enterprise IT and network infrastructure security

DESIRED SKILLS:

• Deep expertise in Navy and DoD program office RMF authorization processes and workflows strongly preferred
• Demonstrated experience managing simultaneous unclassified and classified RMF packages through full authorization lifecycle in Navy or DoD enterprise IT environments
• Familiarity with DoD enterprise IT modernization programs including Navy shore network infrastructure, network exchange points, and related digital transformation initiatives
• Experience working directly with Authorizing Officials, SCA teams, and program offices to resolve complex security control deficiencies and drive packages to authorization
• Background in Navy or DoD network infrastructure security including SD-WAN, switching, routing, firewall, and wireless network security architectures
• Experience supporting continuous monitoring programs for large-scale DoD enterprise IT environments with multiple simultaneously authorized systems
• Familiarity with DoD cloud security authorization processes including FedRAMP and DoD Cloud Computing Security Requirements Guide (CC SRG)
• Experience performing internal auditing functions in support of ISO/IEC 27001 or related standards
• Background in cybersecurity policy development and enterprise security architecture in Navy or DoD environments
• Experience with Assured Compliance Assessment Solution (ACAS), SCAP Compliance Checker (SCC), or related vulnerability scanning and compliance tools
• Familiarity with Navy Qualified Products List (QPL) and Approved Products List (APL) processes for security tool selection and implementation
• Experience mentoring and providing technical guidance to junior ISSE and cybersecurity team members in complex DoD program environments

Target salary range: $160,001 - $200,000. The estimate displayed represents the typical salary range for this position based on experience and other factors.