Sr. SECURITY SPECIALIST/ISSM (CLOUD-CYBER)

Quantum Research International Inc; Huntsville (AL); On-site; USD 120,000 - 170,000; Full time

Job summary

Quantum Research International Inc in Huntsville, AL, seeks an experienced Sr. Security Specialist / ISSM to maintain the system security posture for an Army program, ensuring RMF compliance and ongoing monitoring.

The role requires RMF, NIST, and DISA STIG/SRG expertise, plus hands-on use of ACAS, Nessus, and SCAP. You will develop ATO artifacts, coordinate with government stakeholders, and guide infrastructure teams toward secure operations onsite.

Qualifications

• Develop and maintain ATO documentation (CMP, AMP, ISCP, IRP, BIA, PIA, SSP, CONOPS).
• Identify STIGs and SRGs for technologies used within the Information System (IS).
• Coordinate with government SO/ISM to operate under established ATO.
• Advise on RMF alignment with NIST guidelines and DISA STIG/SRG compliance.
• Provide security design guidance across RMF to ensure control compliance.
• Oversee daily security operations: monitor controls, logs, vulnerabilities, and remediation.
• Act as CM facilitator and voting CCB member for security-related changes.
• Prepare SIAs for SCRs to support CCB decisions.
• Perform annual reviews of general and privileged accounts.
• Review assessments and risk data using ACAS, Nessus, SCAP for mitigation.
• Serve as IS POC to the SCA.
• Establish RMF governance, authorization readiness, and POA&M oversight.
• Advise leadership on cyber risk, authorization readiness, Zero Trust, cloud security.

Responsibilities

• Develop and maintain ATO documentation (CMP, AMP, ISCP, IRP, BIA, PIA, SSP, CONOPS).
• Identify STIGs and SRGs for IS technologies.
• Coordinate with government SO/ISM to ensure operation within ATO.
• Advise on RMF and NIST/DISA compliance.
• Provide security design guidance across RMF phases.
• Oversee daily security operations and remediation.
• Act as CM facilitator and voting CCB member.
• Prepare SIAs for SCRs for CCB review.
• Perform annual account reviews for general and privileged users.
• Review security assessments using ACAS, Nessus, SCAP; identify mitigations.
• Serve as IS POC to the SCA.
• Govern RMF execution and POA&M oversight.
• Advise leadership on cyber risk and emerging requirements.

Skills

RMF knowledge

NIST Guidelines

DoD RMF

Security risk assessment

ISSM experience

Policy compliance

Tools

ACAS

Nessus

SCAP

Job description

Overview:

Quantum's Corporate Office is located in Huntsville, AL, but Quantum actively hires for positions nationwide and internationally. We pride ourselves on providing high quality support to the U.S. Government and our Nation's Warfighters. In addition to our corporate office, we have physical locations in Aberdeen, MD; Colorado Springs, CO; Crestview, FL; Orlando , FL and Tupelo, MS.

Mission:

Quantum Research is seeking an experienced Sr. Security Specialist / Information System Security Manager (ISSM) to support the an Army Program maintained within the Army's Enterprise Cloud Management Agency (ECMA). The Sr-level ISSM will be responsible for maintaining the system's overall security posture IAW DoD RMF requirements. This role includes facilitating and participating in Configuration Control Board (CCB) meetings, evaluate proposed system and architecture changes to confirm security baselines are maintained through approved change management processes, and executing continuous monitoring activities such as reviewing system audits logs, general/privileged user account reviews, RMF documentation creation/maintenance, vulnerability response (CTOs/IAVAs), Information System Contingency Plan (ISCP) Table-Top exercises, and security control artifact development. The ISSM will maintain oversight of configuration management, security scanning and remediation activities, manage the Plan of Action and Milestones (POA&M), and provide cybersecurity guidance to infrastructure team members and on-site personnel to ensure compliance and risk reduction.

Job Responsibilities:

• Develop and maintain ATO related documentation to include Configuration Management Plan (CMP), Account Management Plan (AMP), Information System Contingency Plan (ISCP), Incident Response Plan (IRP), Business Impact Analysis (BIA), Privacy Impact Analysis (PIA), System Security Plan (SSP), and Concept of Operations (CONOPS).
• Identify the correct applicable Security Technical Implementation Guides (STIGs) and Security Requirements Guides (SRGs) for technologies used within the Information System (IS).
• Communicate and coordinate with the government System Owner (SO) and/or government ISM to ensure the system operates within the conditions of the established ATO.
• Advise the program on IS security requirements, ensuring alignment with RMF, applicable NIST Guidelines/Standards, and DISA STIG/SRG compliance.
• Provide security design guidance and analysis to project stakeholders across all RMF phases to ensure alignment with security control requirements.
• Oversee daily system security operations by monitoring control effectiveness, validating access controls, reviewing security audit logs, tracking vulnerabilities, responding to CTOs/IAVAs within government customer's SharePoint site, and coordinating remediation efforts to maintain an acceptable security posture.
• Act as the Configuration Management (CM) facilitator and voting CCB member, overseeing change control processes and participating in formal decision-making for system modifications affecting security posture and compliance.
• Prepare Security Impact Assessments (SIAs) for all System Change Requests (SCRs) to support Configuration Control Board (CCB) review and decision-making.
• Perform annual account reviews and approve all general and privileged user account requests prior to creation, ensuring proper authorization, access justification, and compliance IAW approved policies and procedures.
• Review technical security assessments, analyze vulnerabilities, and risk data using ACAS, Nessus, and SCAP scan results to identify system vulnerabilities, non-compliance, and appropriate mitigation strategies.
• Serve as the IS primary POC when communicating with the Security Control Assessor (SCA).
• Establishes technical priorities and governance for RMF execution, security controls, authorization readiness, continuous monitoring, vulnerability management, and POA&M oversight
• Advises senior leadership, system owners, program managers, and technical officials on cyber security risk, authorization readiness, vulnerability priorities, Zero Trust, cloud security, modernization, and emerging requirements

Required Skills and Qualifications

• Develop and maintain ATO related documentation to include Configuration Management Plan (CMP), Account Management Plan (AMP), Information System Contingency Plan (ISCP), Incident Response Plan (IRP), Business Impact Analysis (BIA), Privacy Impact Analysis (PIA), System Security Plan (SSP), and Concept of Operations (CONOPS).
• Identify the correct applicable Security Technical Implementation Guides (STIGs) and Security Requirements Guides (SRGs) for technologies used within the Information System (IS).
• Communicate and coordinate with the government System Owner (SO) and/or government ISM to ensure the system operates within the conditions of the established ATO.
• Advise the program on IS security requirements, ensuring alignment with RMF, applicable NIST Guidelines/Standards, and DISA STIG/SRG compliance.
• Provide security design guidance and analysis to project stakeholders across all RMF phases to ensure alignment with security control requirements.
• Oversee daily system security operations by monitoring control effectiveness, validating access controls, reviewing security audit logs, tracking vulnerabilities, responding to CTOs/IAVAs within government customer's SharePoint site, and coordinating remediation efforts to maintain an acceptable security posture.
• Act as the Configuration Management (CM) facilitator and voting CCB member, overseeing change control processes and participating in formal decision-making for system modifications affecting security posture and compliance.
• Prepare Security Impact Assessments (SIAs) for all System Change Requests (SCRs) to support Configuration Control Board (CCB) review and decision-making.
• Perform annual account reviews and approve all general and privileged user account requests prior to creation, ensuring proper authorization, access justification, and compliance IAW approved policies and procedures.
• Review technical security assessments, analyze vulnerabilities, and risk data using ACAS, Nessus, and SCAP scan results to identify system vulnerabilities, non-compliance, and appropriate mitigation strategies.
• Serve as the IS primary POC when communicating with the Security Control Assessor (SCA).
• Establishes technical priorities and governance for RMF execution, security controls, authorization readiness, continuous monitoring, vulnerability management, and POA&M oversight
• Advises senior leadership, system owners, program managers, and technical officials on cyber security risk, authorization readiness, vulnerability priorities, Zero Trust, cloud security, modernization, and emerging requirements

Desired Skills and Qualifications

• Broad experience with a variety of enterprise computing infrastructure and public and private computing technologies.
• Experience with modern application architecture, design, development, and deployment processes.
• Experience with configuration management and change management processes in a secure environment.
• Self-starter with the ability to independently identify, prioritize, and execute required tasks
• SC2 CISSP Certification
• AWS/Azure experience

Note: This position is part of Quantum Research Intl 's CAOC (Computing Architecture Operations Center) and is an onsite position in Huntsville, AL

#LI-JL1, #LI-Onsite

Equal Opportunity Employer/Affirmative Action Employer M/F/D/V:

All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, national origin, age, disability, veteran status, genetic information, sexual orientation, gender identity, or any other characteristic protected by law. *Reasonable accommodations may be made to enable individuals with disabilities to perform the essential functions.