Information Systems Security Engineer with Top Secret Clearance

CALNET Inc.

2d•Onsite

About The Position

CALNET is looking for an Information Systems Security Engineer with a Top Secret Clearance to provide services to the Naval Facilities Engineering Systems Command (NAVFAC) Marianas Command Information Office (CIO), ensuring the confidentiality, integrity, and availability of systems, networks, and data through the planning, analysis, development, implementation, documentation, maintenance, and enhancement of information systems security programs, policies, procedures, and tools.

Requirements

Security+ or CCSP or Cloud+ or GICSP or GISF or GSEC or RCCE Level 1 or CISSO or CISSP-ISSEP or CySA+ or FITSP-O or GCLD or GCSA or GSNA certification
Bachelor’s degree in Computer Science, IT, or equivalent experience
US Citizen
Active Top Secret Clearance
Recommended minimum of 5 years of RMF experience
Recommended minimum of 1 year of specialized experience working on Facility-Related Control Systems (FRCS) performing Risk Management Framework (RMF) and cybersecurity engineering tasks
Demonstrated ability to operate independently with minimal government supervision
Ability to communicate in English fluently and effectively in oral and writing
Demonstrated ability to write comprehensive technical reports, security policies, and procedures, and communicate effectively with other governmental professionals, system owners, and the Information Systems Security Manager (ISSM)
Capable of the physical exertion required to perform the necessary services such as long periods of standing; walking over rough, uneven or rocky surfaces; recurring bending, crouching, stooping, and reaching; climbing upon ladders; lifting and moving IT equipment (up to 25 lbs); and other physical activity common to the performance of such duties and have sufficient vision to identify safety concerns.
Fully qualified in accordance with DoDM 8140.03 for Cyber Workforce Work Role 461 (Systems Security Analyst) at the intermediate or advanced proficiency level prior to onboarding.

Nice To Haves

Experience with Facility-Related Control Systems (FRCS)

Responsibilities

Drive the end-to-end Risk Management Framework (RMF) lifecycle (Steps 1-6) in strict accordance with the latest published Department of the Navy (DoN) and NAVFAC Echelon II guidance, including verifying system inventories and artifacts for compliance, completeness, and quality, and ensuring accurate formatting and upload into the Enterprise Mission Assurance Support Service (eMASS).
Execute comprehensive ISSE activities to achieve, maintain, and track Authorities to Operate (ATOs) for Facility-Related Control Systems (FRCS), including facilitating comprehensive annual security reviews and drafting/submitting Memorandums for Record (MFRs) for system baseline changes during RMF Step 6.
Develop, author, and maintain comprehensive security policies, standard operating procedures (SOPs), and implementation plans across all applicable NIST SP 800-53 security control families, tailored to the FRCS operational environment and ensuring strict alignment with DoN and NAVFAC Echelon II cybersecurity directives.
Develop, maintain, and execute a comprehensive Vulnerability Management Strategy. Execute vulnerability and compliance assessments using approved DoN tools (e.g., ACAS, SCAP, Evaluate STIG). Perform manual STIG and Security Requirements Guide (SRG) validations (via .ckl/.cklb checklists), generate appropriately formatted Security Center and eMASSter reports for seamless eMASS integration, and ensure all vulnerability scan results are accurately uploaded and maintained within the Vulnerability Remediation Asset Management (VRAM) database.
Sustain robust System-Level Continuous Monitoring (SLCM) operations, including conducting routine vulnerability scans, performing audit log analysis, driving vulnerability remediation/mitigation, and ensuring accurate, quarterly Plan of Action and Milestones (POA&M) updates.
Deliver targeted on-site validation and testing support to satisfy RMF Step 4 requirements, actively coordinating with system owners and independent validators to ensure seamless site assessments and accurate technical evidence collection.
Serve as a dedicated technical representative and/or Configuration Management (CM) Officer on the Configuration Control Board (CCB), providing authoritative security impact analyses and risk assessments for proposed FRCS baseline modifications.
Execute rapid incident response operations in direct support of the NAVFAC CIO. Serve as an operational member of the MAR Cyber Emergency Response Team (CERT), which mandates participation in designated on-call rotation schedules to guarantee continuous cyber defense coverage.
Dynamically prioritize and coordinate technical support across all FRCS environments, regardless of project type or phase. Provide bi-weekly RMF status reports to the Information Systems Security Manager (ISSM). Create, maintain, and update FRCS RMF project status records within Maximo and/or eProjects on a strict bi-weekly cadence.