Cybersecurity Engineer

Description

CLEARANCE REQUIRED FOR START:

Yes

CLEARANCE TYPE:

Top Secret/SCI with CI Polygraph

LOCATION:

Fort Meade, MD

Nortex Cyber Solutions is seeking an experienced

Cybersecurity Engineer / Information Systems Security Engineer (ISSE) to support the security authorization, assessment, and continuous monitoring of mission-critical information systems.

This position requires a strong technical understanding of the Risk Management Framework (RMF), security controls, system hardening, vulnerability management, and the development and maintenance of authorization packages. The ideal candidate can independently evaluate system security, identify and document risk, maintain traceable bodies of evidence, and work with engineering teams to implement practical security solutions throughout the system lifecycle.

The individual must be comfortable working within classified environments and accessing and maintaining security packages within NSA environments.

• Support the full
  
  Risk Management Framework (RMF) lifecycle for information systems seeking or maintaining authorization.
• Develop, review, maintain, and update system security authorization packages and supporting bodies of evidence.
• Apply and interpret security controls and requirements in accordance withNIST SP 800-53andDoD Instruction 8510.01 (RMF for DoD IT).
• Use security package management and governance tools such aseMASSandXactato develop, maintain, track, and manage system authorization documentation.
• Scope security assessments and conduct assessments of information systems undergoing accreditation/authorization or maintaining an existing authorization.
• Support the preparation, coordination, and approval of Interim Authorizations to Test (IATTs) for systems requiring testing prior to full authorization.
• Evaluate system configurations against applicableDISA Security Technical Implementation Guides (STIGs),CIS Benchmarks, and other security configuration standards.
• Conduct and analyze vulnerability assessments using tools such asACAS/Security Center and Nessus.
• Review vulnerability scan results, determine applicability and risk, track remediation activities, and support the development and maintenance of Plans of Action and Milestones (POA&Ms), as applicable.
• Work closely with system engineers, developers, and other technical stakeholders to implement and validate security controls.
• Support the implementation of automated solutions for continuous monitoring of security controls, vulnerabilities, configurations, and other security requirements.
• Identify opportunities to improve RMF, assessment, evidence collection, and continuous monitoring processes through automation.
• Appropriately leverage AI-enabled tools when beneficial while maintaining sufficient cybersecurity and RMF expertise to independently understand, validate, and take responsibility for the intended outcome.
• Maintain organized, accurate, and traceable documentation demonstrating the relationship between security requirements, implemented controls, assessment results, findings, remediation activities, and supporting evidence.
• Participate in Agile development and engineering environments and work effectively withinSAFe Agile processes.
• Communicate security risks, findings, and requirements clearly to both cybersecurity and engineering stakeholders.

• ActiveTS/SCI clearance with CI Polygraph required at time of hire.
• Ability to access required classified environments and security packages within NSA systems.
• Strong working knowledge of theDoD Risk Management Framework (RMF) and the complete authorization lifecycle.
• Strong knowledge ofNIST SP 800-53security and privacy controls andDoDI 8510.01.
• Experience developing, reviewing, and maintaining RMF authorization packages and supporting bodies of evidence.
• Hands-on experience witheMASS and/or Xactafor security package and authorization management.
• Strong understanding ofDISA STIGs, CIS Benchmarks, system hardening, and security configuration requirements.
• Experience usingACAS/Security Center and Nessusfor vulnerability scanning, analysis, and remediation support.
• Experience scoping and conducting security assessments for information systems undergoing or maintaining authorization.
• Knowledge of theIATT processand experience supporting systems requiring authorization for testing.
• Understanding of continuous monitoring requirements and approaches for validating security controls throughout the system lifecycle.
• Ability to work with technical teams…