Information Systems Security Engineer - Keyport, WA

Arcfield•Keyport, WA

25d

About The Position

The Information Systems Security Engineer provides technical and programmatic information assurance services to internal and external customers in support of network and information security systems. Working under general supervision, the engineer applies technical standards, principles, and theories to solve technical problems of moderate scope and complexity. The role designs, develops, and implements security requirements within business processes and supports the development and implementation of security architectures that address evolving requirements. The position supports Assessment and Authorization (A&A) and Continuous Monitoring activities to ensure compliance with Risk Management Framework (RMF) requirements across multi-level classification environments and diverse technologies and services. It maintains System Security Plans, boundary diagrams, and hardware and software inventories in eMASS; runs weekly ACAS scans and uses SSC to verify DISA STIG compliance; tracks vulnerabilities and mitigation statements; and updates POA&Ms. The engineer coordinates with engineering teams and the ISSM to ensure ATO packages are complete, accurate, and ready for submission. Other work includes preparing security test and evaluation plans and certification and accreditation documentation; conducting risk and vulnerability assessments, security audits, and incident investigation support; analyzing policies and procedures against federal laws and regulations; and recommending security improvements and risk mitigation strategies. The role requires a bachelor's degree and eight to ten years of related experience in information assurance and information systems security engineering, including certification and accreditation work using frameworks such as DIACAP, NIACAP, NIST SP 800-37, and/or DCID 6/3.

Requirements

Bachelor's degree and eight to ten years of related experience performing a wide variety of information assurance and information systems security engineering duties, including certification and accreditation of information systems using DIACAP, NIACAP, NIST SP 800-37, and/or DCID 6/3 frameworks.
CompTIA Security+ certification.
Possess and maintain a SECRET security clearance.
Familiarity and experience using eMASS, ACAS, and SSC.
Knowledge of and experience with the Navy A&A/RMF process.

Responsibilities

Provide technical and programmatic information assurance services for network and information security systems.
Design, develop, and implement security requirements within organizational business processes.
Prepare security documentation using accepted guidelines and customer-provided information.
Prepare Security Test and Evaluation plans.
Support certification and accreditation, including development of security and contingency plans.
Conduct complex risk and vulnerability assessments and develop risk mitigation strategies.
Analyze policies and procedures against federal laws and regulations and recommend actions to close gaps.
Develop and complete system security plans and contingency plans.
Recommend system enhancements to address security deficiencies.
Develop, test, and integrate computer and network security tools.
Secure system configurations, install security tools, scan systems for compliance, report results, and evaluate products and system administration.
Conduct security program audits and develop solutions to reduce identified risks.
Develop strategies to comply with privacy, risk management, and e-authentication requirements.
Support the development and implementation of security architectures that meet evolving security requirements.
Evaluate, develop, and enhance security requirements, policies, and tools.
Assist with computer incident investigations.
Support A&A and Continuous Monitoring activities to ensure RMF compliance across multi-level classification environments.
Update System Security Plans, boundary diagrams, and hardware and software lists in eMASS.
Run weekly ACAS scans and use SSC to check DISA STIG compliance.
Track vulnerabilities, document mitigation statements, and update POA&Ms.
Coordinate with engineering teams and the ISSM to ensure ATO packages are complete, accurate, and ready for submission.