Enterprise Cyber Security SME-Principal

Odyssey Systems Consulting Group, Ltd.•Bedford, MA

About The Position

Odyssey is hiring an Enterprise Cybersecurity Subject Matter Expert to provide enterprise-level cybersecurity expertise to the SW&SS Directorate program offices. The role develops and implements consistent cybersecurity processes across the Directorate portfolio in coordination with Government cybersecurity staff, advises the Government, and implements its direction and guidance. The position integrates cybersecurity throughout acquisition, upgrade, and modification programs, from design and development through testing, fielding, operation, and sustainment, and supports DoD cybersecurity authorization processes and Directorate Risk Management Framework (RMF) compliance. The SME supports cybersecurity and information-security processes and functions, including reviewing system data, managing required IAVAs and NOTAMs, tracking cybersecurity posture, advising division leadership on architecture mitigations, and presenting system risk posture to senior stakeholders. The role applies NIST 800-series publications and emerging Cybersecurity Framework requirements to develop system artifacts, interpret requirements, support compliance, or provide operational justification for exceptions. The position also improves management of RMF packages and controls in eMASS, Xacta, and SGN/CORE as needed; supports cybersecurity authorization documentation; reviews security design and test documentation; assists with RMF control implementation and validation plans; and supports ITIPS and Federal Information Security Modernization Act documentation.

Requirements

Must be a U.S. citizen.
Must have an active Top Secret clearance with SCI.
Bachelor's degree.
IAT Level II certification or equivalent, with ability to obtain IAM Level III.
At least 25 years of directly related experience, including 15 years of relevant DoD experience; alternatively, a relevant master's degree and at least 20 years of experience in the technical or professional discipline, including 12 years of DoD experience.
Demonstrated experience building, managing, and navigating eMASS packages through the complete RMF lifecycle to achieve IATT and ATO.
Experience in software engineering, secure coding practices, and direct administration or engineering of DevSecOps CI/CD pipelines.
Experience securing and evaluating virtualization technologies, container orchestration platforms such as Kubernetes, and hypervisors.
Experience engineering or assessing systems designed to meet Zero Trust Architecture principles in NIST SP 800-207.
Familiarity with securing Department of Defense Cloud Computing Security Requirements Guide requirements across various impact levels.
Advanced knowledge, experience, and recognized expertise in the relevant technical or professional field.
Advanced knowledge of the discipline and comprehensive understanding and ability to apply associated standards, procedures, and practices.

Nice To Haves

Master's degree.
IAM Level III certification.

Responsibilities

Establish enterprise-level cybersecurity SME capability for Directorate program offices and develop consistent cybersecurity processes in coordination with Government staff.
Advise the Government and provide recommendations, while implementing Government direction and guidance.
Integrate cybersecurity into acquisition, upgrade, and modification programs throughout design, development, testing, fielding, operation, and sustainment.
Support DoD cybersecurity authorization processes and oversee Directorate RMF compliance.
Review system data and manage or implement required IAVAs, NOTAMs, compliance notifications, and cybersecurity posture activities.
Advise division leadership on architecture mitigations to reduce system risk and represent risk posture in briefings and slides for senior stakeholders.
Use NIST 800-series publications and Cybersecurity Framework requirements to develop system artifacts, ensure compliance, interpret requirements, and support operational justifications for exceptions when necessary.
Continuously improve processes and procedures for managing RMF packages, controls, and POA&Ms in eMASS, Xacta, and SGN/CORE as needed.
Assist the Government in preparing cybersecurity authorization documentation, including ATPs, ATTs, ATOs, ATCs, POA&Ms, ADDs, and Security Plans.
Review cybersecurity documentation for Security Design and Security Test & Evaluation requirements.
Identify RMF controls, develop implementation and validation plans, and assist with entering and reviewing information in ITIPS.
Assist with preparation and review of Federal Information Security Modernization Act documentation.
Perform tasks and oversee the efforts of junior- and mid-level personnel.