Cyber Security Specialist

Tuknik Government Services, LLC a Koniag Government Services company, is seeking a Cyber Security Specialist to support TGS and our government customer in Oak Ridge, TN. The position is hybrid, requires 2 days onsite (varies but average 2 times every two weeks or so). This position requires an active DOE Q clearance or DoD Top Secret (TS) clearance, or the ability to obtain one.

Benefits include medical, dental, and vision insurance, 401(k) retirement plan, paid time off, paid parental leave, life and disability insurance, flexible spending accounts, commuter benefits and tuition reimbursement.

• Attend cybersecurity, authorization, risk, assessment, and contractor oversight meetings with the AODR and other stakeholders as requested.
• Support the AODR throughout the system authorization and continuous monitoring lifecycle, including independent technical review of authorization packages and supporting evidence.
• Review System Security Plans (SSPs), security control implementation descriptions, assessment results, POA&Ms, implementation plans, impact assessments, risk categorizations, risk assessments, technical justifications, and other authorization artifacts for completeness, consistency, and technical sufficiency.
• Identify cybersecurity risks, control deficiencies, evidence gaps, authorization conditions, and residual-risk considerations and provide documented analysis and recommendations.
• Review proposed risk responses and POA&M content and provide recommendations concerning technical sufficiency, milestones, remediation priorities, and closure evidence.
• Support tracking of authorization conditions, findings, corrective actions, POA&Ms, and other risk-treatment activities through closure or Government disposition.
• Review HQ initiatives, Executive Orders, BODs, data calls, and other requirements and provide impact analyses and recommendations.
• Assess the application of applicable cybersecurity requirements across the information systems and provide documented recommendations for resolution of gaps and risks.

• Plan and perform Government-authorized continuous monitoring and security control assessment activities for system boundaries, including applicable IIS/OT, NSS, GSS, UCNI, and other designated environments. Develop or support assessment plans defining scope, systems, controls, evidence, assessment methods, schedule, personnel, technical testing, and Rules of Engagement (ROE).
• Use examination, interview, testing, technical validation, vulnerability analysis, and other approved assessment methods.
• Perform full Security Test and Evaluation (ST&E) activities when directed by the Government.
• Document assessment results in ISCM reports, SARs, ST&E reports, or other Government-approved formats.
• Support follow-up validation of remediation and closure evidence for assessment findings and POA&M items.

• Assess vulnerability and patch-management compliance for designated boundaries, including CISA Known Exploited Vulnerabilities (KEV) and BOD 22-01 requirements. Analyze scan results, missing patches/updates, configuration weaknesses, false positives, compensating controls, and remediation evidence, and provide risk-based findings and recommendations.

• Support DOE oversight of contractor cybersecurity programs by reviewing evidence, assessing implementation of requirements, identifying gaps and risks, and providing documented recommendations.
• Support coordination of cybersecurity activities associated with internal/external audits, inspections, reviews, and assessments.
• Review new cybersecurity projects and significant…