Information System Security Engineer (ISSE)

Kentro•Washington, DC

About The Position

Kentro is hiring for an Information System Security Engineer (ISSE) in support of a multi-workstream comprehensive Artificial intelligence (AI) enabled cybersecurity modernization project for a U.S. Government program that includes automation, cybersecurity engineering, defense operations, continuous monitoring, Risk Management, security assessments and compliance, and cybersecurity automation platforms. This modernization effort encompasses the security tools, processes, and workflows that support the client’s full cybersecurity mission — transitioning from legacy manual approaches to an integrated, automated, AI-enabled operating model that streamlines cybersecurity processes and workflows while reducing the operational burden and improving the overall cybersecurity posture of the client’s enterprise systems. In this role, the ISSE will design and implement automated compliance workflows using eGRC platforms and automation tools to move the client from manual, document-heavy compliance processes to an automated, data-driven Risk Management Framework (RMF) program. The ISSE will use machine-readable standards such as OSCAL and apply automation and AI-enabled tools to speed up security documentation, control assessment, and continuous monitoring. The ISSE will work with system owners, ISSOs, engineers, assessors, and Authorizing Officials to get to Authority to Operate (ATO) faster and to sustain continuous ATO (cATO) without compromising security. Compensation Range: The pay range for this position is $150,000-180,000 annually. Kentro determines compensation by evaluating current government contracting and commercial market conditions, as well as the role’s specific requirements. Final salary placement within this range will be based on the candidate’s relevant skills, experience, education, certifications, location, and security clearance level, where applicable. This Job Description reflects the primary duties of the role; however, it is not intended to be all‑inclusive. Team members may be asked to take on additional responsibilities in alignment with customer expectations, business needs, and Kentro’s culture of collaboration and adaptability.

Requirements

Bachelor's degree in Cybersecurity, Information Systems, Computer Science, Engineering, or a related field. Equivalent experience may substitute.
8+ years of experience in information security, with at least 5 years of hands-on RMF implementation and ATO support for federal or DoD systems.
Deep working knowledge of NIST SP 800-37, 800-53 Rev. 5, 800-53A, 800-137, and FIPS 199/200.
Demonstrated experience with eGRC or compliance automation platforms, preferably ServiceNow and RegScale.
Experience integrating security tools through REST APIs and working with structured data formats (JSON, XML, YAML).
Scripting or automation skills in Python, PowerShell, or similar languages for compliance data processing and tool integration.
DoD 8140 / 8570 IAT Level III or IAM Level II–III compliant certification, such as CISSP, CISM, or CGRC (formerly CAP).
Excellent written communication skills, with a track record of producing high-quality security documentation.
Must be able to obtain and maintain a Public Trust clearance.
US Citizen or Lawful Permanent Resident (Green Card)

Nice To Haves

Hands-on experience authoring or consuming OSCAL content.
Experience applying generative AI or LLM tools in a regulated environment, including prompt design, output validation, and governance.
Familiarity with FedRAMP authorization processes, including FedRAMP 20x modernization efforts.
Knowledge of cloud security architecture in AWS GovCloud, Azure Government, or Google Cloud for Government.
Experience with DevSecOps pipelines and embedding security gates into CI/CD workflows.
Knowledge of CMMC, NIST SP 800-171, or the DoD Cybersecurity Reference Architecture.
Additional certifications such as CCSP, CISSP-ISSEP, CISA, AWS/Azure security specialty, or ServiceNow/RegScale platform training/certification.

Responsibilities

Lead security engineering across all seven steps of the RMF lifecycle (NIST SP 800-37 Rev. 2), from categorization through continuous monitoring, for complex on-premises, cloud, and hybrid systems.
Build security and privacy requirements into system architecture and design reviews, applying NIST SP 800-53 Rev. 5 controls, tailored baselines, and applicable overlays.
Support to develop, review, and maintain authorization packages. These include System Security Plans (SSPs), Security Assessment Reports (SARs), Plans of Action and Milestones (POA&Ms), and supporting artifacts.
Advise Authorizing Officials and stakeholders on risk posture, residual risk, and risk acceptance decisions.
Architect, configure, and administer GRC platforms (i.e. ServiceNow) and automated tools (i.e. RegScale, etc.) to automate control implementation tracking, evidence collection, assessments, and POA&M management.
Design a compliance-as-code approach using OSCAL to create machine-readable SSPs, component definitions, assessment plans, and results.
Integrate the eGRC platform and automated tools (i.e. RegScale) with enterprise tools through APIs. Examples include vulnerability scanners (Tenable, Qualys), SIEM (Splunk, Elastic), configuration management, CI/CD pipelines, and asset inventories. The aim is near-real-time compliance visibility.
Build data exchanges with authoritative government systems of record such as ServiceNow, eMASS, CSAM, or Xacta.
Establish reusable control inheritance models, common control providers, and standardized component libraries across the client's system portfolio.
Evaluate, pilot, and put into operation automated/AI tools that support compliance work. Uses include drafting control implementation narratives, mapping controls across frameworks, analyzing evidence, identifying gaps, and prioritizing POA&M items.
Set up human-in-the-loop review processes, validation criteria, and quality controls so that AI-generated content is accurate, traceable, and defensible to assessors.
Assess AI tools and systems against relevant security and governance requirements, including the NIST AI Risk Management Framework (AI RMF 1.0), applicable OMB AI guidance, and agency AI policies. Address data handling, model risk, and supply chain concerns.
Ensure AI tool use complies with data classification, CUI handling, and FedRAMP authorization requirements.
Design and implement Information Security Continuous Monitoring (ISCM) strategies that support ongoing authorization and cATO objectives.
Support Zero Trust Architecture initiatives aligned with federal and DoD Zero Trust strategies, and map ZT capabilities to control requirements.
Develop dashboards and metrics that give leadership clear, current views of compliance status, risk trends, and program maturity.
Oversee secure configuration baselines and hardening using DISA STIGs, SRGs, and CIS Benchmarks, and automate compliance verification where possible.
Serve as a technical advisor to government leadership on RMF modernization and automation strategy, tool selection, and process improvement.
Develop standard operating procedures, playbooks, and training so ISSOs and system teams can use the new automated workflows.
Mentor junior security engineers and compliance analysts.
Communicate complex technical and risk concepts clearly to technical and non-technical audiences.

Benefits

paid time off
healthcare benefits
supplemental benefits
401k including an employer match
discount perks
rewards
education reimbursement for certifications, degrees, or professional development
flexibility for you to take a course, complete a certification, or other professional growth and networking
funds for activities – virtual and in-person – e.g., we host happy hours, holiday events, fitness & wellness events, and annual celebrations.
charity galas/events