Federal Cybersecurity Engineer

Who Are We? 
Groundswell is a premier technology integrator resolutely committed to solving the most complex challenges facing federal agencies today. Our name, Groundswell, represents our commitment to be an unstoppable, seismic change in government. Ours is a small company culture with big company reach and results.  Are you ready to be audacious, be bold and drive change at a rapid pace?  Join us, where we’ll make a greater impact together.
 

What You'll do:

Groundswell is seeking a Federal IT Cybersecurity engineer with experience in Department of Defense cybersecurity authorization. In this role, you will act as an Information System Security Officers (ISSO), collaborate with the Government, and guide the project team through the ATO process for complex security requirements including unclassified IL4/5 and classified network authorizations.

Job Objectives and Responsibilities

• Serve as a cybersecurity project liaison with multiple system ISSOs working to ensure security objectives are met as well as ensuring security improvement actions are evaluated, validated, and implemented as required

• Serve as the cybersecurity leader assisting with conduct of Assessments and Authorizations, including responsibility to maintain security controls and related artifacts for compliance with FISMA, NIST, and IRS standards in the agency cybersecurity information management system

• Assessment and Authorization (A&A) work includes, but not limited to, technical documentation, working authorization packages in Xacta assessing cybersecurity vulnerabilities, engineering responses for system Plan of Action and Milestones (POAM), conducting risk analysis for Risk Acceptance Requests (RAR) and providing cybersecurity support for the program

• Support all Risk Management Framework (RMF) activities to include obtaining Interim Authority to Test (IATT), Authority to Operate (ATO) and supporting Ongoing Security Assessments (OSA) including updating control implementation statements and providing evidence to compliance assessment activities

• Support creating or updating security documentation such as System Security Plan, Contingency Plan, Incident Response Plan, Privacy Impact Assessment, and other similar documents

• Assist determining typical sets of controls such as firewalls, security of business systems, data leakage protection systems, patching, encryption, vulnerability scanning, pen testing

• Document and maintain all security tools and technology

• Keep the management informed on the state of the information security program

• Any other tasks as required / tasked by the management team

Skills, Knowledge and Experience Required

• US Citizen with active Top Secret or SCI clearance, preference given to candidates with active SCI DoD security clearance, or candidate must be clearable per contract requirements

• Must be local to DC metro area for working in SCIF approximately 3-4 days per week

• 7+ years' experience in cybersecurity documentation and system authorization artifacts in DoD environment (system security plan, lifecycle documentation, continuous monitoring plan, security assessment plan, security assessment report, risk assessment, etc.)

• Strong working knowledge of Information Assurance (IA) concepts such as patch management, multi-factor authentication, host-based security, intrusion detection, security event management and defense-in-depth is required

• Working knowledge of cybersecurity controls for the assessment of mission systems

• Working knowledge of Information Assurance (IA) technologies, NIST standards, DoDI 8500.2 and SP 800-53, DoD cyber security policy requirements set forth in DoDI 8500.01, “Cybersecurity,”  and DoDI 8510.01, “Risk Management Framework (RMF) for DoD Information Technology (IT)”

• Recent hands-on Assessment and Authorization (A&A) experience with extensive Risk Management Framework (RMF) packages

• Experience with Plan of Actions and Milestones (POAM), Information Assurance Vulnerability Management (IAVM), and compliance reporting for mission systems

• DoDI 8570 certification (i.e.,  GSEC,  Security+,  SCNP,  SSCP) or higher

• At least one Security Certification (in order of preference):

  • Certified Information Systems Security Professional (CISSP)

  • Certified Info Sys Auditor (CISA)/Certified Info Sec Manager (CISM)<