Cybersecurity Engineer III

INFORMATION SYSTEMS SOLUTIONS, INC•San Diego, CA

1d•$170,000 - $180,000•Onsite

About The Position

Information Systems Solutions (ISS) is seeking a Cybersecurity Engineer III to support the NIWC PAC Information Technology Management Support Services contract. The role supports Assessment and Authorization (A&A) accreditation efforts and maintains cybersecurity monitoring operations. It involves triaging incidents to assess their scope and impact, identifying vulnerabilities, and recommending remediation strategies. The position requires in-depth knowledge of the Risk Management Framework and is 100% onsite. The engineer tests and applies security controls based on security categorization, applicable overlays, and security control tailoring. The role also includes reconnaissance and assessment of data; authoring POA&Ms with accurate, verifiable mitigations and milestone tracking; developing A&A documentation; and maintaining accreditation-cycle tasking, connections, inherited controls, and workflow schedules.

Requirements

Secret clearance.
IAM II certification.
One of the following certifications: CAP, CASP, CISM, CISSP (or Associate), or GSLC.
10 or more years of experience in cybersecurity or incident response.
Cybersecurity monitoring and incident response skills.
Security testing, auditing, and remediation skills.
Data analytics and risk assessment skills.
Proficiency with IT security software and web security tools.
In-depth knowledge of the Risk Management Framework.

Nice To Haves

Certified Information Systems Security Professional (CISSP) certification is preferred.

Responsibilities

Test and apply security controls based on security categorization, overlays (including privacy, classified, and intelligence), and security control tailoring (including AI and NOFORN).
Conduct active and passive reconnaissance of data.
Assess and author Plans of Milestones and Actions (POA&Ms), including accurate and verifiable mitigation statements, milestone tracking, and assignment to the most relevant security control.
Develop required A&A documentation, including System Security Plans (SSPs), Security Assessment Plans (SAPs), and Security Assessment Reports (SARs).
Adhere to scheduled eMASS tasking throughout the accreditation cycle, including quarterly Independent Verification and Validation (IV&V), quarterly STIG checks, Annual Security Review (ASR), monthly POA&M updates, and resubmissions for ATO, ATC, IATC, and IATT as applicable.
Maintain DISA circuit connections (CCSDs), inheritance from accredited systems and cloud service providers, and accreditation workflow schedules.
Maintain cybersecurity monitoring operations, triage incidents to determine scope and impact, identify vulnerabilities, and recommend remediation strategies.