Cybersecurity Engineer

Kentro • Springfield, VA

5d • Onsite

About The Position

IT Concepts dba Kentro is hiring a Cybersecurity Engineer to support the NGA Vertex Information Technology Services Task Order. The role supports information system security engineering and assessment for NGA classified and unclassified systems, including continuous monitoring for up to 16 SPIDs. The position is onsite at NGA in Springfield, Virginia, with travel to Bluemont, Virginia as needed for scanning and Data Transfer Officer support.

The engineer develops and maintains security documentation and procedures, conducts security reviews, inspections, tests, and vulnerability assessments, and provides authorization recommendations. The role also advises program stakeholders on security engineering throughout the system life cycle and supports compliance with applicable NGA, national, Department of Defense, and Intelligence Community requirements. The anticipated annual base salary range is $145,000–$180,000.

Requirements

• At least 5 years of related field or work experience is estimated.
• Valid certification meeting DoDI 8570.01-M and DoDD 8140.01 Level II requirements.
• Demonstrated experience with Risk Management Framework assessment and authorization activities and processes.
• Demonstrated experience with vulnerability management.
• Demonstrated understanding of cybersecurity best practices.
• Demonstrated technical understanding of physical, virtualized, and cloud computing.
• Demonstrated understanding of computer networking.
• TS/SCI clearance with polygraph, or ability to obtain a polygraph.
• U.S. citizenship.

Nice To Haves

• Bachelor of Science degree preferred, but not required.
• Ability to effectively communicate cybersecurity concepts to partners, stakeholders, and customers.

Responsibilities

• Develop, write, and maintain an Information Systems Security Program and applicable system security documentation for up to 16 SPIDs under continuous monitoring.
• Maintain customer notification and enforcement processes for security policy changes in coordination with government points of contact and support contractors.
• Conduct periodic SSP compliance reviews, including reviews within three business days of notification of a reported incident.
• Maintain and document configuration management for security-relevant software, hardware, and firmware, including monthly reviews of firmware versions and notification of required updates.
• Review and endorse system assessment documentation and recommend actions to the Authorizing Official or Delegated Authorizing Official.
• Establish and provide approved procedures for clearing, purging, declassifying, and releasing system memory, media, and output.
• Maintain current and historic system assessment documentation and modification records in a repository.
• Coordinate and conduct information system security inspections, tests, and reviews as tasked.
• Develop and update procedures for security incident response, investigation, and reporting; ensure appropriate protection or corrective measures are taken when incidents or vulnerabilities are identified.
• Establish data ownership and responsibilities for each information system, including accountability, access rights, and special handling requirements.
• Develop and maintain procedures for authorizing system software, hardware, and firmware.
• Notify the Authorizing Official or Delegated Authorizing Official when a system no longer processes intelligence or SAP information, and notify management and the AO/DAO of changes that may affect assessment and authorization.
• Ensure system security requirements are addressed throughout all phases of the system life cycle and maintain A&A status documents.
• Provide security engineering input to development documentation, requirements and design reviews, and system testing for CONUS and OCONUS systems.
• Provide security engineering advice and guidance to the ISSO, ISSE, Security Control Assessor, OCIO, and NGA program managers.
• Maintain knowledge of system functions, security policies, technical safeguards, and operational security measures; create and update SOPs.
• Perform tests and scans with NGA-accepted tools to assess compliance and identify security vulnerabilities, risks, threats, and gaps; transfer scan results to Xacta in accordance with NGA policies.
• Prepare scan reports and POA&M documents, conducting monthly scanning for up to 16 SPIDs with up to 1,200 controls per SPID.
• Review SSPs, test documented systems, and endorse those found acceptable.
• Ensure new baseline software is added to the agency-approved whitelist through the approved process.
• Evaluate and prepare or staff system security plans, authorization agreements, CONOPS, ISAs, MOUs/MOAs, diagrams, SRTMs, and other information system documentation in coordination with the government point of contact.
• Evaluate classified and unclassified NGA systems against national, DoD, IC, and NGA security requirements for their specified classification levels.
• Establish testing requirements, coordinate and conduct formal assessment testing, perform vulnerability assessments, determine residual risk, prepare assessment finding reports, and provide formal authorization recommendations.
• Provide Data Transfer Officer duties for IX requests as needed.
• Travel to Bluemont, Virginia as needed for scanning and DTO support.

Benefits

• Paid time off.
• Healthcare benefits.
• Supplemental benefits.
• 401(k) with employer match.
• Discount perks and rewards.
• Education reimbursement for certifications, degrees, or professional development.
• Flexible opportunities to take courses, complete certifications, and pursue professional growth and networking.
• Virtual and in-person activities, including happy hours, holiday events, fitness and wellness events, and annual celebrations.

What This Job Offers

• Job Type: Full-time
• Career Level: Mid Level
• Education Level: No Education Listed