Senior Cybersecurity SME/SCA

M9 Solutions•Chantilly, VA

6d•$180,000 - $190,000•Onsite

About The Position

M9 Solutions is seeking a Senior Cybersecurity SME/SCA to work onsite in support of a government contract for a client located in Chantilly, VA. An active Top Secret clearance is required. This role involves providing strategic advisement, advanced assessment, and expertise in Zero Trust and next-generation architectures, as well as stakeholder engagement and liaison.

Requirements

Active Top Secret security clearance.
Bachelor’s degree in Information Technology, Computer Science, or related field (or equivalent experience).
Minimum of twelve (12) years of demonstrated experience in IT, cybersecurity engineering, and Assessment & Authorization (A&A), with increasing responsibility.
Significant and proven multi-domain experience with SAP and SCI Systems, to include PIT, Cloud environments, Cross Domain Solutions.
Active baseline certification equivalent to DoD 8140.01 / 8570.01-M Information Assurance Workforce Improvement Program (IA WIP) for IAT Level III or IAM Level III (e.g., CISSP, CISM, GSLC, CASP+ CE).
Aptitude for aligning cyber risk management with real-world mission outcomes, proactively tailoring security assessments to enable and protect the mission rather than imposing dogmatic compliance hurdles.
Ability to translate complex technical vulnerabilities into clear, operational risk statements (Mission Impact) for executive leadership and the AO.
Deep understanding of system architectures, data flows, port/protocol matrix analysis, and network boundary defense concepts.
Proficiency in analyzing outputs from technical tools such as ACAS, SCAP, STIG Viewer, Splunk/SIEMs, and cloud security posture management (CSPM) tools.
Expertise in securing and assessing Cloud environments (AWS, Azure IL5/IL6) and containerized applications (Kubernetes, Docker).
Understanding of MASS, Xacta, or similar A&A workflow tools within classified and unclassified environments.

Nice To Haves

Direct experience working within the defense innovation ecosystem, specifically with rapid prototyping, test environments, and Platform IT (PIT) systems.
Proven hands-on technical experience working as a systems integrator or cybersecurity engineer, specifically with enterprise networks, cloud computing systems, and/or all-domain platform IT architectures.

Responsibilities

Actively participate in System Requirements Reviews (SRR), Preliminary Design Reviews (PDR), and Critical Design Reviews (CDR) to ensure security is integrated from the start.
Guide project teams in integrating automated security testing (SAST/DAST) and continuous compliance monitoring into Agile development pipelines.
Conduct system-level threat modeling during the design phase to identify potential attack vectors and recommend architectural mitigations.
Conduct deep technical reviews of vulnerability scans, STIG checklists, and penetration testing reports, correlating technical findings to actual operational risk.
Demonstrate mastery of RMF policies (NIST SP 800-53 Rev 5, CNSSI 1253, DoD 8510.01, ICD 503) and assist the government Authorizing Official (AO) by translating complex technical compliance shortfalls into actionable, mission-contextualized risk decisions.
Evaluate the security performance, integrity, and residual risk of varied environments, including Platform Information Technology (PIT), hardware/software systems, communication networks, and satellite control systems.
Drive the adoption of Zero Trust architectural pillars across all client portfolios.
Provide specialized expertise in designing, evaluating, and implementing Cross Domain Solutions (CDS).
Continuously monitor state-of-the-art technologies and the evolving threat landscape to ensure client systems anticipate and mitigate next-generation threats.
Facilitate seamless communication with the client Portfolio technical SMEs, translating AO directives to engineers and engineering challenges to the AO.
Serve as a key liaison between the Defense Industrial Base (DIB), government cybersecurity entities, security assessment organizations, and Special Access Program (SAP) IT working groups.