Information Assurance Specialist IV

OneZero Solutions•Arlington, VA

About The Position

The Information Assurance Specialist IV is key personnel providing senior Information System Security Officer (ISSO), Security Control Assessor (SCA), and Security Controls Validator (SCA-V) support across DSCA's five IM&T. The role ensures the confidentiality, integrity, and availability of data on assigned systems, leads operationalization of RMF/CSRMC in a cloud-native DevSecOps environment, and drives automation of control implementation, evidence collection, and authorization artifacts in support of A&A, Assess Only, and continuous ATO (cATO) outcomes.

Requirements

Bachelor's degree from an accredited institution in Information Technology, Computer Science, Engineering, or a related technical discipline.
Current DoW 8570/8140 certification meeting the IAM Level II or IAT Level II baseline requirement (e.g., CISSP, Security+ CE, CISM, CASP+ CE).
Five (5) years of dedicated Information Assurance experience, with at least three (3) of those years being consecutive.
Three (3) consecutive years directly relevant to the tasks above, demonstrating a hands-on understanding of the DoW cybersecurity environment.
Active Secret clearance; U.S. citizenship required.
Expert knowledge of RMF, NIST SP 800-53, DISA STIGs, and the Cybersecurity Risk Management Construct (CSRMC).
Master-level proficiency in eMASS as the authoritative system of record for assessment and authorization data.
Familiarity with FedRAMP, DoW Impact Levels, and the DoW Cloud Computing Security Requirements Guide (CCSRG).
Hands-on experience securing AWS cloud-native architectures and authorized SaaS solutions.
Ability to review and validate Compliance-as-Code (CaC) and Policy-as-Code (PaC) profiles, scripts, and automated compliance evidence.
Skill in risk analysis, POA&M development, and drafting decision-quality authorization documentation (SAP, SAR, Authorization Recommendation Memo).
Clear, no-surprises reporting and effective collaboration with system owners, ISSMs,

Responsibilities

Serving as ISSO for assigned DSCA IM&T portfolio systems, ensuring confidentiality, integrity, and availability of data residing on or transiting those systems.
Leading operationalization of the RMF/Cybersecurity Risk Management Construct (CSRMC) within a cloud-native, DevSecOps framework, and automating security control implementation and evidence collection to achieve and maintain A&A, Assess Only, and cATO accreditations.
Proactively identifying and mitigating security weaknesses and maintaining accurate, current security documentation.
Developing the Security Assessment Plan (SAP) and conducting ongoing assessments of security controls beyond periodic compliance checks.
Providing actionable risk analysis that prioritizes vulnerabilities and control deficiencies, and interpreting and validating outputs of automated validation tools and Policy-as-Code scripts.
Developing and maintaining key authorization artifacts, including the Security Assessment Report (SAR), the Authorization Recommendation Memo, and the program's overarching ATO documentation.
Performing SCA-V duties: validating security and compliance content, assessing CaC profiles and scripts, and verifying that automated compliance evidence is correctly ingested and reflected.
Maintaining the eMASS record as the system of record, documenting all assessment activities, findings, and evidence in a timely and accurate manner.
Performing in-depth risk analysis and POA&M support and providing written recommendations for mitigation and validation of proposed corrective actions.
Preparing and assembling the Security Authorization Package and briefing the SCA, ISSM, and other stakeholders on assessment results and residual risk.