Information Assurance and Security Engineer

Peraton•,

3d•$86,000 - $138,000•Remote

About The Position

Peraton is seeking an Information Assurance and Security Engineer to provide technical and programmatic information assurance services to internal and external customers in support of network and information security systems across the DEERS application portfolio. This role involves designing, developing, and implementing security requirements within the organization's business processes, including DevSecOps pipelines, cloud migration activities (OCI), and Agile development sprints. The engineer will prepare and maintain security documentation using accepted DoD and NIST guidelines, including System Security Plans (SSPs), Security Assessment Reports (SARs), Plans of Action and Milestones (POA&Ms), STIG checklists, and implementation plans within eMASS. Responsibilities also include preparing Security Test and Evaluation (ST&E) plans, supporting formal security assessments, and providing Certification and Accreditation (C&A) / Assessment and Authorization (A&A) support. The position requires conducting complex risk and vulnerability assessments, analyzing organizational policies against Federal laws and regulations, and recommending system enhancements. The engineer will also develop, test, and integrate computer and network security tools, secure system configurations, conduct security program audits, and support external audits. Additionally, the role involves providing IA support for security architectures, assisting in computer incident investigations, performing vulnerability assessments, supporting Information Security Continuous Monitoring (ISCM) activities, and maintaining program ATOs and A&I packages. Implementation of JFHQ-DODIN and USCYBERCOM Cyberspace Tasking Orders (CTOs) and ensuring cybersecurity workforce compliance are also key aspects of this position.

Requirements

Minimum of 8 years with BS/BA; Minimum of 6 years with MS/MA; Minimum of 3 years with PhD, 12 years with HS diploma
Ability to obtain and maintain DOD Public Trust
Hands-on experience with the DoD Risk Management Framework (RMF) and associated tooling, specifically eMASS (Enterprise Mission Assurance Support Service).
In-depth knowledge of NIST SP 800-53 Rev 5, NIST SP 800-37, NIST SP 800-171 Rev 2, NIST SP 800-137, FISMA, DoDI 8510.01, and DoDI 8500.01.
Experience conducting vulnerability assessments, developing POA&Ms, and managing the full A&A lifecycle including ATO package development.
Experience with application security scanning tools including Fortify, Sonatype, and BURP; familiarity with OWASP secure coding practices.
Working knowledge of STIG compliance verification, checklist preparation, and remediation.
Demonstrated experience supporting DevSecOps security practices within Agile development environments.
DoD 8140.03 / DoD 8570.01-M compliant certification IAT/IAM Level II (e.g., CISSP, CASP+, CEH, Security+, or equivalent certification).

Nice To Haves

Active Public Trust clearance.
CISSP (Certified Information Systems Security Professional) or equivalent advanced certification.
Experience with cloud security at FedRAMP Moderate, DISA IL-4, or DISA IL-5 authorization levels; familiarity with Oracle Cloud Infrastructure (OCI) security configuration.
Familiarity with CMMC (Cybersecurity Maturity Model Certification) framework and compliance.
Experience supporting external DoD financial/operational audits (FIAR, ICOFR, FISCAM).
Working knowledge of ServiceNow, JIRA, and SharePoint in an ITSM/project context.
Knowledge of DFARS 252.204-7012 cyber incident reporting requirements.
Experience implementing cyberspace tasking orders (CTOs) from JFHQ-DODIN or USCYBERCOM.
Prior experience in the S-ISSO role within a large-scale DoD program environment

Responsibilities

Provide technical and programmatic information assurance services to internal and external customers in support of network and information security systems across the DEERS application portfolio.
Design, develop, and implement security requirements within the organization's business processes, including DevSecOps pipelines, cloud migration activities (OCI), and Agile development sprints.
Prepare and maintain security documentation using accepted DoD and NIST guidelines, including System Security Plans (SSPs), Security Assessment Reports (SARs), Plans of Action and Milestones (POA&Ms), STIG checklists, and implementation plans within eMASS.
Prepare Security Test and Evaluation (ST&E) plans and support execution of formal security assessments in coordination with the DMDC Cybersecurity Division (CSD) and Enterprise ISSOs.
Provide Certification and Accreditation (C&A) / Assessment and Authorization (A&A) support, including development of security and contingency plans, in alignment with DoDI 8510.01 and NIST SP 800-37 RMF principles.
Conduct complex risk and vulnerability assessments; develop and maintain risk mitigation strategies addressing identified weaknesses across the DEERS application environment.
Analyze organizational policies and procedures against Federal laws and regulations — including FISMA, NIST SP 800-53 Rev 5, DoDI 8500.01, and OMB M-14-03 — and provide recommendations for closing identified compliance gaps.
Recommend and implement system enhancements to improve security deficiencies; support IAVA (Information Assurance Vulnerability Alert) monitoring and monthly resolution activities.
Develop, test, and integrate computer and network security tools, including Fortify, Sonatype, and BURP scanning solutions; integrate security scanning into the DevSecOps pipeline for every production release.
Secure system configurations and install security tools; scan systems to determine compliance against STIG and NIST SP 800-53 Rev 5 baselines; report results and evaluate products and system administration configurations.
Conduct security program audits and develop solutions to address identified risks; support 1–3 external audits annually (e.g., DHA MERHCF, DoD CIO ICOFR, FIAR).
Provide IA support for the development and implementation of security architectures to meet new and evolving security requirements, including support for OCI cloud migration at DISA IL-4/IL-5 authorization levels.
Provide assistance in computer incident investigations; report cyber incidents within 1 hour of discovery per DFARS 252.204-7012 and DMDC IR Team protocols, with follow-up reporting every 24 hours until closure.
Perform vulnerability assessments including development of risk mitigation strategies; submit POA&Ms within 3 business days of Category 1 or 2 vulnerability identification and update within 10 business days of vulnerability events.
Support Information Security Continuous Monitoring (ISCM) activities per NIST SP 800-137/137A, DoDI 8530.01, and DoDI 8531.01, and report weekly vulnerability scan status during Integrated Progress Reviews (IPRs).
Maintain and support the program's ATOs and A&I packages through the full RMF lifecycle — Prepare, Categorize, Select, Implement, Assess, Authorize, and Monitor.
Implement JFHQ-DODIN and USCYBERCOM Cyberspace Tasking Orders (CTOs) as directed.
Ensure all cybersecurity workforce personnel are identified, screened, trained, and certified in accordance with DoD 8140.03 and CMMC (DFARS 252.204-7021) requirements.
Conduct and support mandatory security training including OPSEC, CUI Handling, Insider Threat, Privacy Act/PII, IT Security Awareness, Counterintelligence, Antiterrorism Level I, and Records Management.