Information Assurance Specialist III

OneZero Solutions•Arlington, VA

5d•Hybrid

About The Position

OneZero Solutions is seeking Information Assurance Specialists to support the Defense Security Cooperation Agency (DSCA), the DoD agency responsible for the transfer, sale, and lease of U.S. defense articles and services to international partners. As part of the DSCA Cybersecurity Support Services program, you will deliver hands-on Risk Management Framework (RMF) and Cybersecurity Risk Management Construct (CSRMC) support across approximately 25 systems - serving in ISSO, Security Control Assessor, and SCA- Validator capacities within a cloud-native, DevSecOps-oriented AWS environment. This is an execution role at the heart of DSCA's security posture: you will own authorization packages in eMASS, drive controls to compliance, and help move the program from manual assessment toward automated, Compliance-as-Code continuous monitoring.

Requirements

Three (3) years of dedicated Information Assurance experience, with at least two (2) years consecutive, including hands-on RMF execution, security control assessment, POA&M management, and continuous monitoring.
Current DoD 8570/8140-qualifying certification appropriate to the assigned DCWF work role (612/722) - CompTIA Security+ CE minimum.
Active SECRET security clearance (favorably adjudicated T3 investigation) and U.S. citizenship - required at start of performance.
Working knowledge of NIST SP 800-53 (Rev 5), NIST SP 800-37/RMF, FISMA, and DoD cybersecurity policy (DoDI 8510.01).
Ability to work on site at DSCA Mechanicsburg, PA or Arlington, VA as required, including for SIPR-designated work.

Nice To Haves

eMASS experience (package management, control records, POA&M administration).
Experience securing or assessing AWS environments (GovCloud, AWS-native security tooling: Security Hub, Inspector, GuardDuty, Config) and familiarity with FedRAMP and the DoD Cloud Computing SRG.
Exposure to DevSecOps pipelines, Infrastructure-as-Code, or Policy/Compliance-as-Code approaches to control validation.
Vulnerability management experience with ACAS/Tenable Nessus and DISA STIG/SCAP compliance scanning.
CISSP, CISM, CGRC/CAP, CySA+, or CASP+/SecurityX certification.

Responsibilities

Manage Assessment & Authorization (A&A) packages through the RMF/CSRMC lifecycle in eMASS, maintaining the authorization package as the authoritative GRC record - control implementation details, assessment evidence, and full POA&M lifecycle from creation to closure.
Support achievement and maintenance of Assess and Authorize (A&A), Assess Only, and Continuous ATO (cATO) accreditations, including system categorization and control selection, tailoring, and implementation.
Assess security control implementation across traditional and cloud-native services (containers, serverless, service meshes, Infrastructure-as-Code) and evaluate SaaS offerings against FedRAMP and DoD Cloud Computing SRG requirements, documenting shared-responsibility and control inheritance.
Conduct security control assessments as SCA/SCA-V: execute Security Assessment Plans through interviews, documentation review, configuration inspection, and technical testing; independently validate automated and manual test results before findings are formalized.
Develop and maintain RMF documentation - SSPs, control family plans, SAPs, SARs, risk assessments, and POA&Ms - automating documentation and evidence collection wherever possible.
Leverage and interpret Compliance-as-Code (CaC) output (e.g., AWS Inspector, Security Hub, AWS Config) to validate compliance against NIST SP 800-53 controls and DISA STIGs, and verify automated evidence is accurate and audit-ready in eMASS.
Monitor security posture within CI/CD pipelines (SAST/DAST, software composition analysis, container image scanning) and coordinate remediation with development teams before deployment.
Perform risk analysis prioritizing vulnerabilities by mission impact; brief ISSMs, system owners, and Government stakeholders on findings, risk posture, and remediation strategy.
Support incident response for cloud-native systems and coordinate with the CSSP and mission partners as required.