Information Assurance and Security Engineer

Peraton•,

2d•$104,000 - $166,000•Remote

About The Position

Peraton is seeking a seasoned Information Assurance and Security Engineer to serve as an Information System Security Officer (ISSO) for a cloud-hosted, Azure-based system. The role supports mission-critical solutions in a Federal environment and requires security expertise, stakeholder communication, and experience working with Agile software development teams. This position is remote. The engineer provides technical and programmatic information assurance support, develops and implements security requirements, and leads certification and accreditation activities. The role includes preparing security artifacts and plans, assessing risks and vulnerabilities, supporting secure system design and configuration, and coordinating remediation with system administrators and engineering teams. It also supports security audits, incident investigations, root-cause analysis, and continuous security improvement.

Requirements

Bachelor’s degree and 8 years of experience, or master’s degree and 6 years, or associate degree and 10 years, or high school diploma/equivalent and 12 years.
U.S. citizenship and ability to obtain and maintain a DHS Public Trust clearance.
Demonstrated experience performing ISSO duties in a Federal or regulated environment, including creating and maintaining RMF documentation, SSPs, POA&Ms, security test plans, and continuous monitoring artifacts.
Experience supporting software development teams delivering Azure-based cloud solutions, including familiarity with Azure AD, App Services, Key Vault, App Gateway/WAF, and cloud-native security controls.
Hands-on experience identifying, tracking, and managing security vulnerabilities, interpreting scan results such as Tenable/Nessus and Microsoft Defender, and working with engineering teams on mitigations.
Strong understanding of NIST 800-53, 800-30, 800-37, and 800-171 frameworks.
Active CISSP certification or ability to obtain it within 6 months of hire.
Strong communication skills, including developing briefing materials, presenting technical concepts to nontechnical stakeholders, and supporting customer engagements.

Nice To Haves

Working knowledge of DHS security policies, controls, and compliance requirements, including DHS 4300A/B, the DHS 4300A Sensitive System Handbook, and associated RMF processes.
Knowledge of Azure security architecture patterns such as Zero Trust, RBAC, network segmentation, PIM, and least-privilege design.
Strong understanding of Agile methodologies and experience collaborating within cross-functional Agile teams, including sprint planning, backlog refinement, and security-focused reviews.
Experience with security automation and DevSecOps workflows, such as GitHub Actions, Azure DevOps pipelines, and IaC security scanning.
Experience implementing continuous monitoring plans, dashboards, and automated control reporting.
Additional security certifications such as ISC2 CAP, ISC2 CCSP, CompTIA Security+, or Azure Security Engineer Associate (AZ-500).

Responsibilities

Provide technical and programmatic information assurance support to internal and external customers for network and information security systems.
Design, develop, and implement security requirements across enterprise- and program-level business processes.
Prepare security documentation and artifacts using customer input and industry guidelines, including NIST RMF and DHS 4300A; lead program certification and accreditation activities.
Develop and maintain security test and evaluation plans and contingency plans.
Conduct risk and vulnerability assessments and prepare formal reports and recommendations.
Analyze policies and procedures for compliance with Federal laws, regulations, and standards, and recommend remediation strategies.
Recommend system enhancements to address deficiencies and improve the security posture.
Design, test, and integrate computer and network security tools; secure system configurations and ensure compliant deployments.
Perform system scans, interpret results, and support system administrators in resolving findings.
Conduct internal security program audits and develop mitigation strategies for identified risks.
Provide technical guidance for secure architecture design supporting evolving mission needs.
Support security incident investigations, root-cause analysis, and response.
Perform vulnerability assessments and develop, document, and track corrective action plans.