IT Cybersecurity Specialist (Infosec)

Warfighting Acquisition University•Huntsville, AL

1d•Onsite

About The Position

This position is in the DoW Acquisition Workforce Personnel Demonstration Project (AcqDemo) within the Title 5 Competitive Service. The role may be filled at the NH-03 or NH-04 level. At NH-03, the employee serves as an Information System Security Officer (ISSO), supporting Risk Management Framework (RMF) execution for information systems. At NH-04, the employee serves as a senior Information Systems Security Manager (ISSM) and principal cybersecurity technical authority for a portfolio of complex, high-profile enterprise systems, programs, and modernization initiatives. The NH-03 role supports security control implementation and assessment, authorization package development, evidence collection, vulnerability tracking, POA&M management, and continuous monitoring. It evaluates control implementation and effectiveness, maintains authorization documentation, analyzes assessment evidence and findings, assesses system changes, and advises system owners and stakeholders on security requirements, risks, controls, remediation, and authorization decisions. It also identifies security weaknesses, recurring vulnerabilities, and control gaps; validates remediation evidence; and develops technical analyses, risk assessments, metrics, reports, and briefings on security posture and authorization status. The NH-04 role establishes technical priorities and governance for RMF execution, authorization readiness, continuous monitoring, vulnerability management, and POA&M oversight. It integrates cybersecurity risk information across systems and programs, reviews significant deficiencies and remediation strategies, and advises leadership on authorization, operational, acquisition, and risk decisions. The role leads coordination across engineering, acquisition, operations, and program organizations and presents executive-level analyses, metrics, trends, and recommendations on portfolio security posture and mission impacts. The position requires a current cybersecurity certification appropriate to the role and grade level under DoD 8140 workforce requirements. Examples include Security+, CySA+, CASP+, CISSP, CISM, or an equivalent ISSO/ISSM qualifying certification. The position may require a security clearance, overtime, irregular shifts, weekend work, and travel away from the normal duty station. Warfighting Acquisition University requires employees to report to their assigned duty location during each pay period. Telework may be available under agency policy; remote work and full-time telework are not offered.

Requirements

U.S. citizenship is required.
Males must be registered for Selective Service.
Must meet applicable qualification and time-in-grade requirements within 30 days of the announcement closing date.
Must demonstrate IT-related competencies in attention to detail, customer service, oral communication, and problem solving.
Must have one year of specialized experience at the next lower broadband level or equivalent: NH-03 requires NH-02/GS-11-equivalent experience; NH-04 requires NH-03/GS-13-equivalent experience.
NH-03 specialized experience includes supporting RMF lifecycle activities such as categorization, control selection and implementation, assessment preparation, authorization package development, and continuous monitoring.
NH-03 specialized experience includes familiarity with FedRAMP authorization, continuous monitoring, cloud security control implementation, shared responsibility models, and secure configuration practices for federal cloud environments.
NH-03 specialized experience includes preparing, reviewing, and maintaining RMF artifacts such as System Security Plans, control implementation statements, Security Assessment Reports, POA&Ms, risk acceptance documentation, assessment artifacts, and continuous monitoring records.
NH-03 specialized experience includes analyzing vulnerability scan results, configuration compliance data, audit findings, system changes, and assessment results to identify risk, support remediation, validate closure evidence, and document compensating controls.
NH-03 specialized experience includes practical understanding of Zero Trust architecture initiatives across ICAM, device compliance, network segmentation, application security, data protection, telemetry, and automation pillars.
NH-04 specialized experience includes leadership or advisory responsibility for RMF execution for complex, high-visibility, or enterprise information systems.
NH-04 specialized experience includes preparing, reviewing, and approving organizational cybersecurity and RMF policies, directives, procedures, and instructions.
NH-04 specialized experience includes leading RMF planning, authorization readiness, control implementation reviews, assessment coordination, continuous monitoring, POA&M governance, risk acceptance analysis, and risk recommendations for leadership.
NH-04 specialized experience includes reviewing and validating authorization packages, security control evidence, vulnerability remediation strategies, cloud security responsibilities, system interconnections, software assurance results, and major system changes.
NH-04 specialized experience includes advising system owners, program managers, technical teams, assessors, contractors, and leadership on RMF execution, documentation quality, control implementation, audit readiness, vulnerability prioritization, Zero Trust alignment, and secure system lifecycle requirements.
NH-04 specialized experience includes leading cross-functional coordination among acquisition, engineering, operations, security, and executive stakeholders.
A current cybersecurity certification appropriate to the role and grade level under DoD 8140 is required; examples include Security+, CySA+, CASP+, CISSP, CISM, or an equivalent ISSO/ISSM qualifying certification.
An appropriate security clearance may be required to be obtained and maintained.
May be required to serve a one-year probationary period.
Must be able to start employment within 30 days of acceptance unless otherwise approved by WarU.
Education is not substitutable for specialized experience at this grade level.
Applicants must clearly identify duties and responsibilities and total hours per week for part-time or unpaid experience.

Responsibilities

Support RMF lifecycle execution for information systems, including security control implementation and assessment, authorization package development, evidence collection, vulnerability tracking, POA&M management, and continuous monitoring.
Evaluate security control implementation and effectiveness; maintain authorization documentation; analyze assessment evidence and findings; and monitor security posture.
Provide cybersecurity guidance and recommendations to system owners and stakeholders on security requirements, risks, controls, remediation, and authorization decisions.
Analyze security documentation, vulnerability and configuration data, assessment findings, and system changes to identify weaknesses, evaluate risk, and recommend remediation, mitigation, or compensating controls.
Evaluate cybersecurity impacts of system changes and resolve or recommend solutions for complex issues involving vulnerabilities, control deficiencies, technical limitations, and mission and security requirements.
Coordinate with technical stakeholders to validate remediation actions and security evidence and determine whether deficiencies have been adequately addressed.
Identify gaps, risks, recurring vulnerabilities, and systemic control weaknesses; recommend corrective actions and risk mitigation strategies.
Develop technical analyses, risk assessments, metrics, reports, and briefings on system security posture, authorization status, vulnerabilities, remediation, and continuous monitoring results.
At NH-04, establish technical priorities and governance for RMF execution, security controls, authorization readiness, continuous monitoring, vulnerability management, and POA&M oversight across a portfolio.
At NH-04, interpret and apply federal, DoW, organizational, and emerging cybersecurity requirements to resolve complex issues and promote consistent portfolio risk management.
At NH-04, integrate cybersecurity risk information across systems and programs and review or validate significant control deficiencies, remediation strategies, compensating controls, cloud security, system interconnections, software assurance, and major system changes.
At NH-04, develop risk-management strategies and advise leadership on authorization, operational, acquisition, and risk decisions.
At NH-04, advise senior leaders, system owners, program managers, and technical officials on cybersecurity risk, authorization readiness, vulnerability priorities, Zero Trust, cloud security, modernization, and emerging requirements.
At NH-04, lead cross-functional coordination across engineering, acquisition, operations, and program organizations to resolve significant cybersecurity issues.
At NH-04, present executive-level risk analyses, metrics, trends, and recommendations on portfolio security posture, systemic risks, and issues affecting mission execution.
Meet the applicable DoD 8140 cybersecurity certification requirement for the role and grade level.