Senior Information Security Specialist

PEMCCO•Washington, DC

About The Position

PEMCCO is seeking a Senior Information Security Specialist to lead security, compliance, risk management, and authorization activities supporting government information systems and network environments. The role is responsible for supporting the security and compliance of complex information systems and technology environments throughout their lifecycle. The specialist works with program leadership, engineers, system administrators, developers, and government stakeholders to implement and maintain cybersecurity requirements. The position leads security initiatives, supports Risk Management Framework (RMF) and Assessment & Authorization (A&A) activities, assesses risk, and helps organizations maintain compliant security postures. It also contributes to vulnerability management, continuous monitoring, incident response, audits, inspections, and authorization reviews. The specialist prepares security documentation, reports, briefings, assessments, and recommendations, and provides technical guidance and mentorship to security team members. Work may take place in professional office and technical environments at company facilities, customer locations, or designated project sites as needed. The role involves regular use of computers, cybersecurity tools, and communication systems, with frequent collaboration across technical teams, program leadership, customers, and other stakeholders.

Requirements

Bachelor's degree in Cybersecurity, Information Assurance, Information Systems, Information Technology, Computer Science, Engineering, or a related field.
Ten years of experience in information assurance, information security, cybersecurity, system security, RMF, compliance, or a related field.
Advanced knowledge of information assurance and information protection principles.
Advanced knowledge of RMF processes and security authorization requirements.
Knowledge of NIST, DoD, and federal cybersecurity policies, standards, and regulations.
Knowledge of security controls, vulnerability management, risk assessment, and compliance methodologies.
Ability to identify, assess, and mitigate technology risks and vulnerabilities.
Ability to interpret and apply security policies, standards, and procedures.
Strong analytical, organizational, and problem-solving skills.
Ability to evaluate security control effectiveness and recommend improvements.
Strong written and verbal communication skills, including the ability to communicate effectively with technical and non-technical audiences.
Ability to prepare and review security documentation, assessments, and reports.
Ability to lead cybersecurity efforts and coordinate activities among multiple stakeholders.
Ability to obtain and maintain a government security clearance if required.
Must meet applicable DoD 8140 workforce qualification requirements if required by contract.

Nice To Haves

Master's degree in Cybersecurity, Information Assurance, Information Systems, Information Technology, Computer Science, Engineering, or a related discipline.
Experience supporting Department of Defense or Federal Government programs.
Experience leading RMF and Assessment & Authorization activities.
Experience developing and maintaining security documentation and authorization packages.
Experience supporting continuous monitoring and vulnerability management programs.
Experience conducting security assessments, inspections, audits, and compliance reviews.
Experience mentoring security and information assurance professionals.

Responsibilities

Lead information system security activities throughout the system lifecycle.
Manage and support Risk Management Framework (RMF) and Assessment & Authorization (A&A) processes.
Develop, review, and maintain System Security Plans (SSPs), Security Assessment Reports (SARs), Plans of Action & Milestones (POA&Ms), and related cybersecurity documentation.
Conduct security assessments, compliance reviews, vulnerability analyses, and risk assessments.
Evaluate implemented security controls and recommend corrective actions and improvements.
Identify, document, track, and support remediation of security vulnerabilities and compliance deficiencies.
Support continuous monitoring activities and maintain visibility into overall system security health.
Coordinate with system owners, engineers, developers, administrators, and stakeholders to integrate security requirements throughout the system lifecycle.
Advise leadership on risk considerations, compliance requirements, and security best practices.
Support incident response activities, security investigations, and remediation efforts.
Ensure compliance with applicable policies, regulations, standards, and contractual requirements.
Support cybersecurity audits, inspections, and authorization reviews.
Prepare security reports, briefings, risk assessments, and recommendations for leadership and customers.
Provide technical guidance and mentorship to security team members.