Information Assurance Engineer III

IP Secure, LLC•San Antonio, TX

12h•Onsite

About The Position

The Information Assurance Engineer III serves as a cybersecurity and Risk Management Framework specialist. The position maintains continuous authorization readiness, oversees cybersecurity compliance activities, manages authorization evidence, and provides technically supported Information Assurance recommendations to Government leadership, ISSOs, ISSMs, system owners, engineers, and operational stakeholders. The Information Assurance Engineer supports secure and compliant operations across enterprise information systems, cloud-hosted environments, specialized mission networks, and multiple classified and unclassified enclaves. The position ensures cybersecurity risks, vulnerabilities, configuration weaknesses, and compliance deficiencies are identified, documented, communicated, and tracked through closure.

Requirements

Active TS/SCI Security Clearance
Bachelor's degree in Cybersecurity, Information Assurance, Information Technology, Computer Science, Engineering, or a related discipline is preferred. Equivalent relevant education, training, and experience may be considered based on contract and company requirements.
CISSP-ISSMP, GSLC or Legacy CCSP or CISSP Certification
Demonstrated advanced-level experience supporting Information Assurance, cybersecurity governance, RMF, or information system security management.
Experience supporting DoD, Department of the Air Force, Federal Government, or similarly regulated enterprise environments.
Experience preparing and maintaining system authorization packages and cybersecurity evidence.
Experience with vulnerability management, POA&M administration, DISA STIGs, ACAS results, and continuous monitoring.
Experience coordinating cybersecurity activities with ISSOs, ISSMs, system owners, engineers, and operational stakeholders.
Ability to assess technical cybersecurity findings and communicate their mission and operational impact.

Nice To Haves

Experience leading RMF authorization and continuous-monitoring activities for Department of the Air Force DCO systems, DAFIN-SOC environments, or comparable classified DoD systems.
Advanced proficiency with eMASS, ACAS/Tenable Security Center, DISA STIG Viewer, Enterprise Mission Assurance Support Service workflows, and cybersecurity evidence repositories.
Demonstrated experience developing and maintaining authorization packages, security-control implementation statements, POA&Ms, risk assessments, interconnection agreements, contingency plans, and audit-ready evidence.
Expertise analyzing vulnerability scan results, assessing technical and mission risk, coordinating remediation across multidisciplinary engineering teams, and validating findings through evidence-based closure.
Experience implementing NIST SP 800-53, DoDI 8510.01, Air Force cybersecurity directives, DISA STIGs, continuous authorization, and security requirements across classified, cloud, virtualized, and multi-enclave environments.

Responsibilities

Lead and support Risk Management Framework activities throughout the system authorization lifecycle.
Maintain continuous authorization readiness across network certification and accreditation packages.
Develop, review, and maintain cybersecurity authorization documentation, supporting evidence, and compliance artifacts.
Coordinate RMF activities with ISSOs, ISSMs, system owners, engineers, administrators, and Government authorizing officials.
Evaluate cybersecurity risks and provide evidence-based Information Assurance recommendations.
Support authorization reviews, continuous monitoring activities, and recurring compliance assessments.
Ensure cybersecurity documentation accurately reflects the system architecture, operational environment, interconnections, and implemented security controls.
Perform continuous cybersecurity compliance checks and remediation tracking.
Integrate weekly vulnerability scan results into continuous monitoring and remediation processes.
Incorporate quarterly DISA Security Technical Implementation Guide updates into system compliance activities.
Assess security-control implementation and identify compliance gaps requiring corrective action.
Monitor remediation progress and validate closure of identified deficiencies.
Maintain cybersecurity posture information for Government reviews and leadership reporting.
Support compliance standardization across all DAFIN-SOC Operating Locations.
Analyze vulnerability scan results and assess technical and mission risk.
Develop, maintain, and update Plans of Action and Milestones.
Coordinate vulnerability remediation with infrastructure, systems administration, network, virtualization, and cybersecurity operations teams.
Validate corrective actions and maintain evidence demonstrating successful remediation.
Identify overdue or high-risk findings and elevate issues to appropriate Government stakeholders.
Support risk acceptance, mitigation, transfer, and closure recommendations based on documented evidence.
Review system configurations for compliance with applicable DoD, Air Force, NIST, and DISA requirements.
Support implementation and maintenance of DISA STIG-aligned security baselines.
Evaluate configuration changes for cybersecurity impact.
Review hardware, software, firmware, cloud, and virtual infrastructure configurations.
Support inventory, supply-chain risk, and secure-configuration management activities.
Coordinate with configuration management personnel to ensure approved baselines and security documentation remain synchronized.
Review proposed system changes and provide cybersecurity recommendations before implementation.
Manage cybersecurity evidence repositories and perform quality assurance reviews.
Ensure evidence is accurate, current, traceable, and sufficient to support authorization and audit activities.
Maintain interconnection agreements, contingency planning documentation, ACAS reporting artifacts, and related cybersecurity records.
Support inspections, assessments, audits, and Government compliance reviews.
Develop structured compliance summaries, risk reports, and corrective-action recommendations.
Strengthen evidence governance, remediation workflows, and closure validation.
Maintain documentation necessary to demonstrate continuing compliance and operational authorization.
Provide advanced Information Assurance guidance to program leadership and technical teams.
Interpret cybersecurity policies, directives, instructions, and technical implementation requirements.
Develop and maintain cybersecurity procedures, checklists, templates, and governance documentation.
Support cybersecurity metrics, dashboards, risk-trend reporting, and recurring performance reviews.
Promote consistent cybersecurity practices across operating locations and mission environments.
Identify opportunities to improve compliance processes, evidence quality, and remediation efficiency.
Support modernization of cybersecurity reporting and continuous monitoring workflows.
Collaborate with network engineers, Windows and UNIX engineers, virtualization engineers, systems administrators, configuration managers, and security operations personnel.
Review system architecture, interfaces, data flows, accounts, and dependencies for cybersecurity impact.
Support incident, outage, maintenance, and technology-refresh activities when cybersecurity oversight is required.
Participate in change management and technical review processes.
Ensure cybersecurity requirements are incorporated into system sustainment, modernization, automation, and recovery activities.
Support privileged-access reviews and cybersecurity audit requests.
Develop and maintain RMF authorization documentation, security control implementation statements, Plans of Action and Milestones, continuous monitoring documentation, security assessment evidence, ACAS and vulnerability-management reports, interconnection documentation, contingency and recovery artifacts, risk assessments, compliance summaries, standard operating procedures, and checklists.
Prepare status updates, risk summaries, technical recommendations, and leadership briefings.
Document decisions, approvals, remediation actions, validation results, and closure evidence.