Expert Cyber Security Engineer

We need to output HTML fragment with sections: headings

for sections like About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. Only include sections where there is real specific content. We need to parse the job posting and extract relevant content. First, we need to decide sections. The posting includes: - Intro paragraph about cyber security landscape, mission, role description. Could be "About the role" or "Overview". Use

About the role

with paragraphs. - Work Schedule: "Work hours are 9am – 5pm, Monday thru Friday, at least four days at customer or Amentum site." That's schedule. So we can have

Schedule

with

. - Essential Responsibilities: list of duties. So

Responsibilities

with

• . - Work Environment, Physical Demands, and Mental Demands: maybe part of responsibilities or separate? Could be "Work Environment". But we can include under Responsibilities or separate. Since we prefer few substantive sections, maybe combine into Responsibilities. - Minimum Requirements (Knowledge, Skills, and Abilities): includes Skills & Tasks, Essential skills needed. Could be "Requirements" or "Qualifications". We'll have

  Requirements

  with
  . - Job Duties: seems similar to responsibilities; maybe duplicate. We'll need to avoid duplication. The posting repeats responsibilities under "Essential Responsibilities" and then later "Job Duties". We need to preserve all substantive info but not duplicate lines. We can combine them into one responsibilities list, ensuring we capture unique items. - Security Clearance Required: TS/SCI CI Poly. That's a requirement. - Minimum Education: Bachelor's degree plus 10 years’ experience, etc. That's requirement. - Required Certifications: CompTIA Security+ (at a minimum). That's requirement. - Preferred Qualifications: list of items. Could be "Preferred Qualifications" section. - Other Responsibilities: Safety, Quality, Procedure Compliance. Could be part of responsibilities or separate "Other Responsibilities". Might be considered responsibilities. - Compensation Details: Pay range. So

  Pay

  with

  . - Benefits Overview: list of benefits. So

  Benefits

  with
  . - Original Posting date etc: metadata, we can drop or put in short

  maybe under a minor metadata paragraph. The instruction: do NOT put Job ID/requisition numbers as headings — fold minor metadata into a short

  or drop it. So we can include a short

  for posting date maybe. - EEO boilerplate: remove. - #javelin: maybe ignore. We need to preserve all substantive information, not invent or summarize away detail. So we need to include all specifics: e.g., mention of GEODS environments, DISA STIGs, NIST SP 800-53 Rev 5, etc. Must keep them. We need to avoid filler like "commensurate with experience", etc. Not present. We need to output only HTML fragment, no /, no markdown. Let's craft sections:

  About the role

  ... intro paragraph(s) describing mission, role as ISSO and Cyber Security SME, bridging policies, driving RMF/A&A, ensuring system designs meet security objectives, evaluating IT architectures, guiding development teams, enforcing compliance with NIST SP 800-53 Rev 5 and other standards, safeguarding mission-critical systems, reducing organizational risk, proactively identifying/tracking/mitigating vulnerabilities through continuous monitoring, STIG enforcement, POA&M management, leadership in disaster recovery planning and IAVA compliance, empowering engineers to securely deliver operations, protecting integrity and availability.

  We need to ensure we keep all details: mention of "Information Systems Security Officer (ISSO) and Cyber Security Subject Matter Expert", "critical bridge between high-level security policies and their technical implementation", "driving the Risk Management Framework (RMF) and Assessment & Authorization (A&A) lifecycle across multiple applications and environments", "primary purpose is to ensure that system designs and implementations inherently meet rigorous security objectives by evaluating IT architectures, guiding development teams, and enforcing compliance with NIST SP 800-53 Rev 5 and other enterprise standards from concept to deployment", "work directly safeguards mission-critical systems and reduces organizational risk", "proactively identifying, tracking, and mitigating vulnerabilities through continuous monitoring, STIG enforcement, and POA&M management", "ensure the resilience of enterprise capabilities", "leadership in disaster recovery planning and IAVA compliance empowers engineers and developers to securely deliver operations, ultimately protecting the integrity and availability of our technological infrastructure". That's a lot; we can combine into a couple paragraphs. Next, Schedule:

  Schedule

  Work hours are 9am – 5pm, Monday thru Friday, at least four days at customer or Amentum site.

  Next, Responsibilities: combine Essential Responsibilities and Job Duties and Other Responsibilities (Safety, Quality, Procedure Compliance). We'll need to list each duty as
  • . Ensure we don't duplicate. Let's extract list items: From Essential Responsibilities: - Working with Security, Operations, and Development teams to gather information about all the systems, software, components, access permissions, and data flows that are part of the GEODS environments as well as the types of data that are input, manipulated, stored, and output from the authorization boundary. - Documenting this information to create the Body of Evidence artifacts required as part of our Assessment and Authorization (A&A) packages and to maintain the artifacts as systems evolve. - Reviewing reports and scan results to identify vulnerabilities and settings not configured in compliance with applicable DISA STIGs and create patching and remediation plans to protect systems in accordance with Agency requirements. - Documenting clear justifications and exception statements when patching or configuration requirements cannot be met due to adverse functional or performance consequences. - Building good working relationships within the GEODS teams and with agency A&A personnel to understand expectations and deliver required artifacts within prescribed timelines. - Updating information in Service+ including CMDB Inventory information and Service Tickets. From Job Duties: - Gathering situational awareness information of all data and components within the authorization boundary and creating Body of Evidence documentation, such as Concepts of Operations (CONOPs), Control Implementation Plans, Test Plans, Operational Procedures, and Data Flow Diagrams. - Ensuring all program systems, software, and services comply with all applicable: - Cyber Security Controls and Overlays - Best practices and Development frameworks - STIG configurations/Vendor Security Guides - Enterprise Security Services (e.g., CRIBL, Trellix, Carbon Black, etc.) - Performing regular analysis and self-assessments, such as: - Reviewing and analyzing vulnerability scans (e.g., ACAS IAVM scans, Static and Dynamic Code Scans) - Performing manual test plan checks - Documenting non-compliance - POA&Ms - Justifications - Disaster Recovery/Incident Response - Supporting Assessment and Authorization activities: - Completing all required XACTA 360 sections and tasks - Verifying all Body of Evidence deliverables - Providing support with demonstrating A&A Test Plans - Continuous Monitoring: - Working with OPS Team to develop patching strategies - Participating in Development Sprint planning to help support Configuration/Change Management and identify potential Security Relevant Changes - Evaluating proposed security architectures and designs and providing input to ensure they meet required security compliance objectives - Suggesting strategies to improve cyber security posture throughout the development lifecycle and to gain efficiencies From Other Responsibilities: - Safety - Amentum enforces a safety culture whereby all employees have the responsibility for continuously developing and maintaining a safe work environment. As appropriate, each employee is responsible for completing all training requirements and fulfilling all self-aid/buddy aid responsibilities, participating in emergency response tasks and serving on safety committees and teams. - Quality - Quality is the foundation for the management of our business and the keystone to our goal of customer satisfaction. It is our policy to consistently provide services that meet customer expectations. Accordingly, each employee must conform to the Amentum Quality Policy and carry out job activities in compliance with applicable Amentum Quality System documents and customer contracts. Each employee must read and understand his/her Quality Management and Customer Satisfaction responsibilities. - Procedure Compliance - Each employee must read, understand and implement the general and specific operational, safety, quality and environmental requirements of all plans, procedures and policies pertaining to his/her job. We need to keep these as separate list items; some are paragraphs but we can keep as
  • with the text. We must avoid duplication: Some items overlap (e.g., gathering information, documenting Body of Evidence). We'll keep both but maybe they are similar; but instruction says preserve ALL substantive information; do NOT invent or summarize away detail. Duplication is okay if it's in the source? It says remove duplicated lines. So we should deduplicate identical lines. The two sections have overlapping but not identical wording. We'll keep both if they are not exactly same. However, to reduce redundancy we could merge similar meaning but that might be summarizing. Safer to keep both as separate items, but ensure we don't have exact duplicate strings. Let's check: Essential Responsibilities first item: "Working with Security, Operations, and Development teams to gather information about all the systems, software, components, access permissions, and data flows that are part of the GEODS environments as well as the types of data that are input, manipulated, stored, and output from the authorization boundary." Job Duties first item: "Gathering situational awareness information of all data and components within the authorization boundary and creating Body of Evidence documentation, such as Concepts of Operations (CONOPs), Control Implementation Plans, Test Plans, Operational Procedures, and Data Flow Diagrams." These are not identical; keep both. Essential Responsibilities second item: "Documenting this information to create the Body of Evidence artifacts required as part of our Assessment and Authorization (A&A) packages and to maintain the artifacts as systems evolve." Job Duties includes "Creating Body of Evidence documentation, such as ..." plus later "Verifying all Body of Evidence deliverables". Not identical. We'll keep them. Now Requirements / Qualifications: We'll have

    Requirements

    with
    . Items: - Minimum Education: Bachelor's degree plus 10 years’ experience, associate’s degree plus 12 years’ experience, or a minimum of 14 years’ experience in a related field. - Required Certifications: CompTIA Security+ (at a minimum). - Security Clearance Required: TS/SCI CI Poly. - Skills & Tasks (from Minimum Requirements): - Extensive knowledge of all applicable compliance requirement documents, such as NIST SP 800-53 REV 5, CNSSI 1253 and Overlays, DISA Security Technical Implementation Guides (STIGs), and Zero Trust. - Experience with Windows Server, Red Hat Enterprise Linux Server, and Oracle Linux Server Operating Systems, including vulnerability patching methodologies. - Experience with Amazon Web Services (AWS) and Oracle Cloud environments and administration interfaces (e.g., CAP Tool). - Experience with XACTA 360, manually entering as well as importing/exporting information including Security Control Implementation responses, test plans, self-assessments, and other required Body of Evidence documentation. - Analyzing large amounts of data, such as Cloud Inventory reports and Nessus ACAS Security Center IAVM and STIG scan results across multiple instances and environments. - Producing clear, consistent documentation describing the status of all systems, software, and other components within the authorization boundary, as well communicating the procedures used to develop custom code, perform regular operational support of the system, and recover systems/services from disasters. - Essential skills needed: - Attention to detail - Critical thinking - Creative problem solving