About The Position
Support NUWCDIVNPT in a junior-to-mid-level Risk Management Framework (RMF) Information Systems Security Engineer role. Perform Assess and Authorize (A&A) work to maintain systems’ Authorizations to Operate (ATOs), including for applications, networks, and devices. The role involves security and privacy risk management, security control assessment, authorization, and continuous monitoring. Review system security documentation, identify issues, conduct risk assessments, develop RMF packages, and keep the team informed about Navy RMF policies and procedures. Provide eMASS guidance and training, document requirements clearly, and coordinate with stakeholders to track actions through completion.
Requirements
- At least 2 years of professional cybersecurity and RMF experience.
- Demonstrated expert-level experience with the Risk Management Framework.
- Experience in RMF policy development, process improvement, and strategy implementation.
- Expert-level experience developing RMF packages, including POA&Ms and mitigation statements, Security Plans, Risk Assessments, architecture diagrams, asset inventories, and system/site policies, procedures, and processes.
- An 8570.01M IAM/IAT Level II certificate; Security+ is the minimum stated certification requirement.
- Knowledge of National Institute of Standards and Technology Special Publications.
- Ability to manage multiple projects at a time.
- Experience with Assessment and Authorization (A&A), formerly C&A, and RMF and DIACAP.
- Experience with ACAS, STIG OSS Manager, STIGViewer, and eMASS.
- Knowledge of continuous monitoring.
- Excellent customer service and organizational skills.
- Excellent oral and written communication skills.
- Expert-level experience with DISA STIGs and SRGs.
- U.S. citizenship.
- Active Secret security clearance that must be maintained.
- Strong interpersonal and diplomatic skills; ability to handle stress professionally and work independently and with a team.
Nice To Haves
- CAP, CASP, or CISSP certification is preferred.
- Knowledge and experience with practices and procedures for CMMI Software Development Level 3 or greater.
Responsibilities
- Support NUWCDIVNPT in a junior-to-mid-level RMF ISSE role and perform A&A tasks to maintain ATOs for systems, applications, networks, and devices.
- Support a structured process for managing security and privacy risk, including security categorization; control selection, implementation, and assessment; system and common control authorizations; and continuous monitoring.
- Review Assessment and Authorization System Security Plans for existing systems, identify issues with security plans and procedures, execute Security Assessment Plans, process Security Test Reports, review POA&Ms, and conduct risk assessment analysis.
- Keep abreast of Navy RMF policies and procedures and provide updated information to the team; review relevant DoD, DON, and NAVSEA cybersecurity documentation.
- Conduct independent security control assessments in accordance with NIST SP 800-53, NIST SP 800-53A, CNSSI 1253, and the RMF described in NIST SP 800-37.
- Clearly document requirements and other information in materials such as Security Plans, Contingency Plans, Contingency Plan Tests, and Business Impact Analyses.
- Provide eMASS guidance and training to team members.
- Manage multiple tasks and projects, working independently and collaboratively while maintaining organization, time management, reliability, and professional conduct.
- Attend stakeholder meetings, capture and track action items, and follow up with stakeholders to support timely completion.
Benefits
- Health insurance
- Life insurance
- Paid time off
- Holiday pay
- Short-term and long-term disability
- Retirement and savings
- Learning and development opportunities
- Wellness programs
- Optional benefit elections
Stand Out From the Crowd
Upload your resume and get instant feedback on how well it matches this job.
What This Job Offers
Job Type
Full-time
Career Level
Entry Level
