Senior Information Security Engineer

This is a fully remote position, open to applicants in Virginia.

📋 Description

• Act as the main cybersecurity and privacy consultant for System Owners regarding designated systems.

• Oversee RMF activities, which include the creation and upkeep of System Security and Privacy Plans (SSPPs), authorization packages, risk documentation, and accompanying artifacts.

• Ensure systems uphold Authorization to Operate (ATO) through assessment assistance, continuous monitoring, and adherence to NIST RMF, FISMA, and federal security standards.

• Evaluate security risks, confirm security controls, and facilitate the remediation of vulnerabilities alongside Plans of Action and Milestones (POA&Ms).

• Keep system inventories, security documentation, contingency plans, configuration management plans, and privacy documentation updated.

• Work in partnership with ISSMs, System Owners, Security Control Assessors, and technical teams to incorporate security throughout the system lifecycle.

• Supervise system security status, analyze vulnerability and compliance scan findings, and assist in continuous authorization efforts.

• Offer cybersecurity advice, formulate security policies and procedures, and provide security awareness training.

• Assist in security engineering, certification and accreditation processes, and the implementation of security controls across systems.

• Suggest process enhancements and automation opportunities to improve RMF and cybersecurity operations.

⛳️ Requirements

• A bachelor's degree in Cybersecurity, Information Assurance, Computer Science, Information Technology, or a related discipline.

• At least 5–7 years of experience in information assurance, cybersecurity, RMF, or information system security, or an equivalent mix of education and experience.

• Experience in supporting federal cybersecurity initiatives and the NIST Risk Management Framework (RMF).

• Proficient in developing and maintaining RMF documentation, authorization packages, and Governance, Risk and Compliance (GRC) tools.

• Strong understanding of NIST SP 800-37, NIST SP 800-53, FISMA, FIPS 199, and federal privacy regulations.

• Experience in supporting Authorization to Operate (ATO), Continuous ATO (cATO), or Continuous Authorization efforts.

• Excellent analytical, communication, documentation, and stakeholder engagement abilities.

• Certified Information Systems Security Professional (CISSP).

• Certified in Governance, Risk and Compliance (CGRC) or Certified Cloud Security Professional (CCSP).

• Experience working with U.S. federal civilian agencies, ideally the USPTO.

• Familiarity with continuous monitoring, vulnerability management, and security automation.

• Knowledge of cloud security, DevSecOps, and continuous authorization initiatives.

• Understanding of privacy compliance activities, including Privacy Threshold Assessments (PTAs), Privacy Impact Assessments (PIAs), and System of Records Notices (SORNs).

🏝️ Benefits

• Remote work arrangement.