USAF - Cryptologist

cFocus Software Incorporated; United States; On-site; USD 150,000 - 210,000; Full time

Job summary

cFocus Software seeks a Cryptologist to join our USAF program, on-site in Linthicum Heights, MD. This role requires an Active TS/SCI clearance and deep knowledge of cryptographic principles to protect enterprise systems.

The candidate will assess cryptographic implementations, support secure cloud and hybrid integration, and contribute to RMF/ATO activities through technical evaluations and documentation.

Qualifications

• Active TS/SCI clearance required.
• B.S. Computer Science, IT, or related field.
• Experience applying cryptographic principles to protect enterprise systems.
• Knowledge of symmetric/asymmetric cryptography, hashing, signatures, and authentication.
• Experience assessing cryptographic implementations, key management, and certificate trust.
• Ability to evaluate risks, interoperability, and lifecycle dependencies.
• Ability to conduct authorized evaluations and produce evidence.
• Understanding of secure cloud/hybrid integration and configuration control.
• Familiarity with RMF, security control assessment, and RMF documentation for ATO processes.
• Strong analytical, writing, briefing, and cross-team collaboration skills.

Responsibilities

• Analyze mission and system requirements to identify cryptographic protection needs.
• Assess cryptographic implementations for alignment with security architecture and controls.
• Evaluate encryption, hashing, signatures, and authentication mechanisms and document risks.
• Support reviews of key management practices (generation, storage, rotation, revocation, recovery).
• Assess certificate and trust relationships for secure communications and cross-domain integration.
• Support secure integration across on-premises, cloud, and hybrid systems.
• Evaluate cryptographic dependencies in designs and modernization efforts; advise on lifecycle and migration impacts.
• Coordinate with mission partners and engineering teams on protection requirements for data obfuscation capabilities.
• Conduct authorized evaluations of cryptographic controls and workflows; document findings and remediation.
• Support vulnerability analysis, secure config reviews, and patch verification affecting cryptographic capabilities.
• Provide evidence to ISSO/ISSM for RMF/ATO and continuous ATO activities.
• Research emerging cryptographic technologies and best practices; assess benefits and risks.
• Assist incident investigations involving cryptographic services or key/certificate compromise under approved procedures.
• Coordinate cryptographic security checks within DevSecOps and change management processes.
• Prepare assessments, procedures, and decision briefs; communicate findings to government stakeholders.

Skills

TS/SCI clearance

Cryptography knowledge

Security assessment

Technical writing

Briefing

Collaboration

Education

Bachelor's degree in Computer Science/Information Technology

Tools

RMF

ATO processes

Key management

Job description

cFocus Software seeks a Cryptologist to join our program supporting the United States Air Force (USAF).

This position is on-site in Linthicum Heights, MD.

This position requires an Active TS/SCI clearance.

Qualifications:

• Active TS/SCI clearance
• B.S. Computer Science, Information Technology, or a related field
• Experience applying cryptographic principles to enterprise information protection and secure systems.
• Knowledge of symmetric and asymmetric cryptography, hashing, digital signatures, and authentication.
• Experience assessing cryptographic implementations, key management practices, and certificate trust.
• Ability to evaluate technical risks, interoperability, configuration weaknesses, and lifecycle dependencies.
• Ability to conduct authorized technical evaluations and produce reproducible assessment evidence.
• Understanding of secure cloud and hybrid integration, authorization boundaries, and configuration control.
• Working knowledge of RMF, security control assessment, and documentation supporting ATO processes.
• Strong analytical, technical writing, briefing, and multidisciplinary collaboration skills

Duties:

• Analyze mission and system requirements to identify cryptographic protection needs for approved data, applications, communications, and infrastructure.
• Assess cryptographic implementations and configurations for alignment with Government-approved security architecture, policies, and applicable control requirements.
• Evaluate use of encryption, hashing, digital signatures, and authentication mechanisms; document assumptions, limitations, and implementation risks.
• Support reviews of key management practices, including generation, storage, distribution, rotation, revocation, and recovery within approved processes.
• Assess certificate and trust relationships supporting secure communications and system integration; coordinate corrective recommendations with responsible administrators.
• Support secure integration across on-premises, cloud, and hybrid systems, observing approved authorization boundaries and cross-domain requirements.
• Evaluate cryptographic dependencies in proposed designs and modernization efforts; advise on interoperability, lifecycle support, and migration impacts.
• Coordinate with mission partners and engineering teams on protection requirements supporting approved Automated Data Obfuscation capabilities.
• Conduct authorized technical evaluations of cryptographic controls and workflows; document methods, findings, and recommended remediation.
• Support vulnerability analysis, secure configuration reviews, and verification of approved patches or changes affecting cryptographic capabilities.
• Provide technical evidence and documentation to ISSO/ISSM teams for Risk Management Framework (RMF), Authority to Operate (ATO), and continuous ATO activities.
• Research emerging cryptographic technologies and cybersecurity best practices; assess benefits, risks, compatibility, and implementation prerequisites.
• Support incident investigation involving cryptographic services or suspected key or certificate compromise under Government-approved response procedures.
• Coordinate approved cryptographic security checks and configuration controls within DevSecOps pipelines and centralized change management processes.
• Prepare technical assessments, procedures, and decision briefs; communicate findings and recommendations to Government stakeholders and technical teams.