Sr. Information System Security Officer I (6861)

About the role

As a Sr. Cybersecurity Engineer I, you will support a government program by applying NIST SP 800-53 controls, monitoring security posture, analyzing vulnerabilities, and coordinating remediation across AWS, applications, APIs, and infrastructure. The role also includes junior Business Analyst and Project Manager responsibilities, such as defining security requirements, facilitating stakeholder discussions, tracking action items, and reporting progress.

Responsibilities

• Communicate regularly with DHS customers and internal engineering teams to lead required RMF process/steps to assess and authorize a system obtaining and maintaining a full ATO (Authority to operate).
• Perform monthly continuous monitoring reporting to include analysis of scans, logs, accounts, etc.
• Support writing and reviewing of Risk Management Framework (RMF) documentation packages to support risk assessments.
• Design and execute the security testing plan of all requirements and analysis required to complete a RMF package document for submittal and approval.
• Use vulnerability scanning tools and frameworks to evaluate the security posture of a system.
• Assist the customer in preparing training and table top exercises for contingency planning, incident response and disaster recovery.
• Complete ISSO USCIS provided training as required.

Requirements

• Minimum of five years of IT experience as a Security Lead or Information Security Analyst, including evaluation, implementation, or management of security practices for new and existing technologies.
• Bachelor’s degree in Computer Science or a comparable field, or equivalent experience.
• Strong understanding of NIST SP 800-53 controls and their application within the RMF.
• Strong understanding of API-based security mechanisms and the OWASP framework for web application vulnerabilities. Hands-on implementation is not required.
• Experience with AWS architecture and a technical understanding of cloud technologies used in customer environments, including microservices, containers, zero trust concepts, data streaming, or data pipelines.
• Experience