Responsibilities
- Serve as a Senior Cybersecurity Engineer for a Navy program office to support implementation and integration of cyber requirements throughout all stages of the system development lifecycle including requirements gathering, system engineering, deployment and sustainment.
- Review system architecture to identify cybersecurity vulnerabilities and compliance issues.
- Plan and execute cybersecurity scans, including running Assured Compliance Assessment Solution (ACAS)/Tenable scans, DISA Security Technical Implementation Guides (STIGs), evaluating STIG, DISA Security Content Automation Protocol (SCAP) and evaluating the system against vendor security best practices.
- Work with the system developers to remediate and mitigate vulnerabilities on the system.
- Develop system architecture diagrams and data flow diagrams as required.
- Develop a Security Plan of Action and Milestones (POA&Ms) to include mitigation statements.
- Support the Cybersecurity Analyst for the Risk Management Framework (RMF) process to achieve Authority to Operate (ATO) and Interim Authority to Test (IATT).
- Plan and execute system scans to meet client requirements; analyze results, develop reports to determine the system’s vulnerabilities and risk posture, and provide recommendations for remediation to achieve the desired security and risk posture.
- Identify cybersecurity vulnerabilities and compliance issues.
- Work with engineers to remediate existing vulnerabilities or to develop mitigations that minimize impact, likelihood, or risks and work with the program to incorporate findings into the system POA&M.
- Provide Cybersecurity Assessment and Authorization (A&A) support and serve as a cybersecurity expert for the program throughout all stages of acquisition, system engineering, and maintenance.
- Successfully execute the RMF assessment process, develop Security Assessment Plans (SAPs), conduct assessments, and compile assessment results for client security assessment reports.
Requirements
- Active Secret clearance required.
- DoD IAT II certification required.
- Bachelor’s degree in a relevant discipline from an accredited college/university and eight years plus experience in the cybersecurity field or an equivalent combination of work experience and education.
- Experience developing Security Assessment Plans (SAPs).
- Experience conducting Nessus and ACAS scans.
- Experience building an ACAS scanner preferred.
- Experience conducting DISA STIG and SRG on multiple technologies.
- Experience with evaluating STIG preferred.
- Experience with SCAP preferred.
- Experience with implementing security lockdowns for Windows or Red Hat Linux (RHEL) operating systems, network technologies, including firewalls, routers, and switches.
- Good knowledge of Department of War (DoW) cybersecurity policies and procedures.
- Experience using eMasster and eMASS preferred.
- Experience using Jira to create, manage and update work items, including user stories, epics, tasks, and bug reports preferred.
- Strong written and verbal communication skills to advise various levels of technology stakeholders, program initiatives, and accrediting authorities on security requirements and cybersecurity trends and solutions, including risk assessments and mitigations.
- Ability to work independently and be a self‑starter.
Core Competencies
Demonstrates expertise in Cybersecurity Engineering, including the execution of Risk Management Framework (RMF) processes, development of Security Assessment Plans (SAPs), and conducting vulnerability assessments using tools like ACAS and Nessus. Proficient in implementing security measures for various operating systems and network technologies while ensuring compliance with Department of War cybersecurity policies.
Tools & Technologies
- EMASS
- Jira
- Assured Compliance Assessment Solution (ACAS)
- DISA Security Technical Implementation Guides (STIGs)
- Security Content Automation Protocol (SCAP)