Information Assurance Engineer III

Information Assurance Engineer III – TS/SCI Clearance Required – JBSA Lackland - San Antonio, TXJob Description

The Information Assurance Engineer III serves as acybersecurity and Risk Management Framework specialist. The positionmaintainscontinuous authorization readiness, oversees cybersecurity compliance activities, manages authorization evidence, and provides technically supported Information Assurance recommendations to Government leadership, ISSOs, ISSMs, system owners, engineers, and operational stakeholders.

The Information Assurance Engineersupportssecure and compliant operations across enterprise information systems, cloud-hosted environments, specialized mission networks, and multiple classified and unclassified enclaves. The position ensures cybersecurity risks, vulnerabilities, configuration weaknesses, and compliance deficiencies are identified, documented, communicated, and tracked through closure.

• Lead and support Risk Management Framework activities throughout the system authorization lifecycle.
• Maintain continuousauthorizationreadiness across network certification and accreditation packages.
• Develop, review, andmaintaincybersecurityauthorizationdocumentation, supporting evidence, and compliance artifacts.
• Coordinate RMF activities with ISSOs, ISSMs, system owners, engineers, administrators, and Government authorizing officials.
• Evaluate cybersecurity risks and provide evidence-based Information Assurance recommendations.
• Support authorization reviews, continuous monitoring activities, and recurring compliance assessments.
• Ensure cybersecurity documentation accurately reflects the system architecture, operational environment, interconnections, and implemented security controls.
• Perform continuous cybersecurity compliance checks and remediation tracking.
• Integrate weekly vulnerability scan results into continuous monitoring and remediation processes.
• Incorporate quarterly DISA Security Technical Implementation Guide updates into system compliance activities.
• Assess security-control implementation andidentifycompliance gaps requiring corrective action.
• Monitor remediation progress andvalidateclosure ofidentifieddeficiencies.
• Maintain cybersecurity posture information for Government reviews and leadership reporting.
• Support compliance standardization across all DAFIN-SOC Operating Locations.
• Analyze vulnerabilityscanresults and assess technical and mission risk.
• Develop,maintain, and update Plans of Action and Milestones.
• Coordinate vulnerability remediation with infrastructure, systems administration, network, virtualization, and cybersecurity operations teams.
• Validate corrective actions andmaintainevidencedemonstratingsuccessful remediation.
• Identify overdue or high-risk findings and elevate issues to appropriate Government stakeholders.
• Support risk acceptance, mitigation, transfer, and closure recommendations based on documented evidence.
• Review system configurations for compliance with applicable DoD, Air Force, NIST, and DISA requirements.
• Support implementation and maintenance of DISA STIG-aligned security baselines.
• Evaluate configuration changes for cybersecurity impact.
• Review hardware, software, firmware, cloud, and virtual infrastructure configurations.
• Support inventory,supply-chainrisk, andsecure-configuration management activities.
• Coordinate with configuration management personnel to ensure approved baselines and security documentation remain synchronized.
• Review proposed system changes and provide cybersecurity recommendations before implementation.
• Manage cybersecurityevidencerepositories and perform quality assurance reviews.
• Ensure evidence is accurate, current, traceable, and sufficient to support authorization and audit activities.
• Maintain interconnection agreements, contingency planning documentation, ACAS reporting artifacts, and related cybersecurity records.
• Support inspections, assessments, audits, and Government compliance reviews.
• Develop structured compliance summaries, risk reports, and corrective-action recommendations.
• Strengthenevidencegovernance, remediation workflows, and closure validation.
• Maintain documentation necessary todemonstratecontinuing compliance and…