Cyber Security/Information Assurance Engineer

CACI • Chantilly, VA

9d

About The Position

The Cyber Security/Information Assurance Engineer/Technician functions as a Security Control Assessor (SCA), using NIST SP 800-53 and/or 800-53A Revision 4 guidance and procedures to assess management, operational, and technical security controls in complex information systems. The role determines whether controls are correctly implemented, operate as intended, and meet applicable security requirements for National Security Systems. The SCA provides independent evidence to the designated Authorizing Official (AO) about system trustworthiness, identifies and documents risks, recommends countermeasures and corrective actions, and prepares assessment reports. The position also helps protect networks, devices, programs, and data from malicious attack, damage, or unauthorized access, and investigates security incidents to determine potential compromise of national security information and automated information systems.

Requirements

• Bachelor of Science in Cybersecurity, Computer Science, Information Systems, or Computer Systems Engineering.
• At least 7 years of hands-on experience in information security, network security, or systems engineering.
• Knowledge of firewalls, VPNs, IDS/IPS, and endpoint protection.
• Proficiency in Linux, Windows, TCP/IP, and network architecture.
• Understanding of risk assessments, security frameworks, vulnerability management, and incident response.
• Ability to write technical reports and conduct briefings.
• Ability to discern the security-control needs of information systems and other computing environments.

Nice To Haves

• Familiarity with security assessments supporting accreditation and/or authorization decisions.
• Experience writing scripts or code in Python, C++, Java, Bash, or PowerShell for automation and log analysis.
• Familiarity with the NIST Cybersecurity Framework and NIST Risk Management Framework requirements.
• Familiarity with NIST SP 800-53 and/or 800-53A Revision 4, as well as 800-30, 800-37, and 800-39.
• Familiarity with Committee on National Security Systems Instruction No. 1253.
• Knowledge of Federal laws, regulations, policies, and ethics related to cybersecurity.
• Knowledge of cyber defense and vulnerability assessment tools, including open-source tools, and their capabilities.
• Knowledge of cybersecurity principles and organizational requirements relating to confidentiality, integrity, availability, authentication, and non-repudiation.
• Knowledge of cybersecurity principles for managing risks related to the use, processing, storage, and transmission of information or data.
• Knowledge of risk management processes, including methods for assessing and mitigating risk.
• Knowledge of the operational impacts of cybersecurity lapses.
• Knowledge of industry methods for evaluating, implementing, and disseminating IT security assessment, monitoring, detection, and remediation tools and procedures using standards-based concepts and capabilities.
• Knowledge of IT security principles and methods, including firewalls, demilitarized zones, and encryption.
• Knowledge of cyber threats and known vulnerabilities described in alerts, advisories, errata, and bulletins.
• Knowledge of computer networking concepts and protocols and network security methodologies.
• Knowledge of network security architecture concepts, including topology, protocols, components, and defense-in-depth.
• Knowledge of cloud technology.
• Knowledge of system and application security threats and vulnerabilities, including buffer overflow, mobile code, cross-site scripting, PL/SQL and SQL injection, race conditions, covert channels, replay, return-oriented attacks, and malicious code.
• CompTIA Security+, GIAC Security Essentials (GSEC), or Certified Information Systems Security Professional (CISSP) certification.

Responsibilities

• Evaluate Government customer systems against NIST SP 800-53/53A Revision 4, 800-30, 800-37, 800-39, the RMF, other security standards and publications, and customer-defined guidelines and regulations.
• Use the customer assessment tracking system, Xacta-360.
• Act as an independent, unbiased advocate and provide evidence validating system trustworthiness for the designated Authorizing Official.
• Conduct hands-on security control testing; analyze Body of Evidence documentation and test results; document risks; and recommend countermeasures.
• Assess the severity of weaknesses or deficiencies in information systems and their operating environments and recommend corrective actions for identified vulnerabilities.
• Conduct hands-on security testing using commercial tools, custom-developed scripts, and procedures.
• Execute vulnerability and compliance assessment tools and evaluate results for systems undergoing security assessment.
• Participate in joint test teams with customer organizations and Government agencies to complete security assessments and adjudication.
• Coordinate with other program elements conducting security testing.
• Participate in or lead technical exchange meetings and application review boards, and document action items and results.
• Brief management as needed on action-item status and activity results.
• Prepare security assessment reports documenting results and findings from assigned assessments.
• Provide customer documentation describing identified system risks, planned test procedures, and test results.
• Develop enhancement capabilities and standard operating procedures for assessment operations.
• Maintain accountability for the integrity and confidentiality of the assessment process.
• Implement and apply technologies, processes, and practices to protect networks, devices, programs, and data from malicious attack, damage, or unauthorized access.
• Investigate network-device and information-security incidents to determine the extent of compromise to national security information and automated information systems.
• Write technical reports and conduct briefings.

Benefits

• Flexible time off benefit.
• Learning resources and learning and development opportunities.
• Competitive compensation and comprehensive benefits, including healthcare, wellness, financial, retirement, family support, continuing education, and time off benefits.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior