Position OverviewArlo Solutions seeks an experienced
Cybersecurity Technical Specialist III / ISSO to support U.S. Army ATEC cybersecurity operations. The position provides technical expertise in DoD Risk Management Framework (RMF), security-control analysis, vulnerability management, eMASS, POA&M management, and Continuous Monitoring. Candidates must reside near APG or independently relocate before employment.
Full-time, on-site attendance at the Government installation is mandatory. RMF Execution:
- Perform assigned RMF activities under DoDI 8510.01, NIST SP 800-37, NIST SP 800-53/53A, CNSSI No. 1253, and applicable Army requirements.
Security Controls:
- Analyze control implementations, technical configurations, compliance evidence, and deficiencies
- develop accurate implementation statements and corrective recommendations.
eMASS Management:
- Maintain assigned authorization packages, security controls, artifacts, findings, and supporting documentation for ATO/IATT and Continuous Monitoring activities.
Vulnerability Management:
- Review ACAS, SCAP, STIG, and other assessment results;
- validate findings, coordinate remediation, and maintain accurate tracking records.
POA&M Management:
- Document weaknesses, track remediation milestones, validate corrective actions, and maintain supporting evidence and traceability.
Continuous Monitoring:
- Conduct recurring security reviews, identify emerging risks, monitor compliance, and report material cybersecurity changes.
Technical Quality Assurance:
- Independently verify technical accuracy, completeness, evidence, and compliance before submitting deliverables.
Incident Coordination:
- Report significant vulnerabilities, suspected incidents, and security deficiencies through authorized channels.
- Collaborate with Team Leads, ISSMs, System Administrators, security assessors, and Government stakeholders to obtain evidence, validate configurations, resolve findings, and accomplish assigned RMF responsibilities.
- Maintain operational leadership visibility and communicate progress, obstacles, and cybersecurity risks professionally.
- Prepare and present accurate technical briefings covering RMF activities, vulnerabilities, security controls, POA&Ms, and Continuous Monitoring.
- Explain findings, supporting evidence, risks, remediation recommendations, and outstanding actions.
- Provide timely status updates and identify issues requiring leadership attention.
- The assigned Team Lead/O-ISSM serves as the primary operational tasking lead, operating under the oversight of the Project Lead, Program Manager, and authorized Government TPOC.
- Employees must follow reasonable, authorized direction from designated leadership, meet established deadlines, and promptly communicate conflicting instructions, technical concerns, or delays.
- System assignments do not confer exclusive ownership or independent managerial, ISSM, SCA, or Authorizing Official authority.
Professional Attire:
- Maintain APG/ATEC-required professional business attire throughout on-site duty hours, subject to approved exceptions.
Professionalism:
- Demonstrate respect, integrity, accountability, courtesy, and constructive workplace communication.
Customer Relations:
- Maintain professional Government relationships and follow established communication and escalation procedures.
Teamwork:
- Collaborate effectively, respect leadership responsibilities, accept constructive feedback, and support mission priorities.
Technical Accuracy:
- Validate all assigned technical work before submission; promptly correct identified deficiencies.
Policy Compliance:
- Follow Arlo Solutions Employee Handbook requirements, Government workplace policies, security procedures, and authorized operational direction.
Performance Standard:
- Deliver accurate, timely, technically defensible cybersecurity work while maintaining professionalism, accountability, effective communication, and continuous support of the U.S. Army ATEC mission.
Work Location: (On-site Requirements) Aberdeen Proving Ground, MD
Clearance: Active
Secret clearance.
Responsibilities and/or Success Factors: - Execute assigned RMF responsibilities under DoDI 8510.01, NIST SP 800-37, NIST SP 800-53/53A, CNSSI No. 1253, and applicable Army cybersecurity requirements.
- Support system categorization, security-control implementation, assessments, authorization, and Continuous Monitoring.
- Analyze technical configurations, control implementations, compliance evidence, and cybersecurity documentation. Identify deficiencies, unsupported compliance assertions, and documentation inconsistencies; recommend corrective actions.
- Support ATO, IATT, reauthorization, and ongoing authorization requirements.
- Develop, review, maintain, and validate assigned eMASS authorization packages, security controls, implementation statements, assessment evidence, and findings.
- Ensure documentation accurately reflects system configurations, security posture, and compliance status.
- Maintain traceability between security controls, supporting evidence, assessment findings, and POA&Ms.
- Coordinate authorization-package updates, quality reviews, and submissions through established RMF leadership.
- Evaluate NIST SP 800-53 security controls against documented implementations and technical evidence.
- Validate findings, identify compliance gaps, distinguish false positives, and assess inherited controls.
- Develop defensible recommendations for remediation, mitigation, additional assessment, or risk acceptance.
- Coordinate technical validation with authorized System Administrators and cybersecurity stakeholders.
- Review ACAS, SCAP, DISA STIG, and other approved vulnerability assessment results.
- Identify vulnerabilities, configuration weaknesses, affected assets, and compliance deficiencies.
- Conduct recurring vulnerability reviews and maintain accurate Government-approved tracking records.
- Develop and maintain POA&Ms documenting findings, risks, remediation milestones, and supporting evidence.
- Validate remediation before recommending closure; escalate significant unresolved risks.
- Perform recurring security-control reviews, vulnerability assessments, compliance checks, and cybersecurity reporting.
- Identify system changes, emerging threats, and conditions affecting authorization or cybersecurity posture.
- Support Continuous Monitoring documentation, corrective actions, and risk tracking.
- Promptly report suspected incidents, significant vulnerabilities, and security-control failures through authorized channels.
- Support incident-response coordination without independently accepting risk or approving exceptions.
- Prepare accurate, complete, traceable, and technically defensible cybersecurity deliverables.
- Independently verify technical findings, asset identifiers, control mappings, vulnerability references, and evidence before submission.
- Correct errors, unsupported assertions, and documentation inconsistencies promptly.
- Maintain version control, documentation integrity, and compliance with established quality standards.
- Collaborate with Team Leads, ISSMs, System Administrators, security assessors, and Government stakeholders.
- Coordinate evidence collection, technical investigations, remediation, and RMF activities.
- Prepare and present technical briefings addressing vulnerabilities, controls, POA&Ms, risks, and authorization status.
- Communicate progress, blockers, outstanding findings, and corrective recommendations professionally.
- Maintain leadership visibility and avoid unauthorized commitments.
Minimum Qualifications Including Certificates: Education and Professional Experience:
- Bachelor's degree in Cybersecurity, Computer Science, Information Technology, Information Assurance, Engineering, or related field; equivalent experience may qualify when permitted by contract.
- Demonstrated experience supporting DoD, U.S. Army, or federal cybersecurity programs.
- Hands-on experience performing ISSO, Risk Management Framework (RMF), information assurance, or equivalent cybersecurity responsibilities.
- Strong understanding of NIST SP 800-53 security controls, RMF processes, cybersecurity compliance, and authorization requirements.
- Experience reviewing security-control implementations, technical evidence, vulnerability findings, and cybersecurity documentation.
- Experience supporting authorization packages, Plans of Action and Milestones (POA&Ms), and Continuous Monitoring.
- Ability to independently analyze technical cybersecurity issues, validate findings, and produce accurate, defensible deliverables.
- Strong analytical, organizational, documentation, communication, and problem-solving skills.
Technical Knowledge and Experience
- Candidates must demonstrate applicable knowledge and practical experience in:
- DoD RMF: DoDI 8510.01, NIST SP 800-37, NIST SP 800-53/53A, CNSSI No. 1253, and applicable DoD/Army cybersecurity requirements.
- eMASS: Authorization-package maintenance, security-control documentation, implementation statements, assessment evidence, findings, and workflow support.
Vulnerability Management:
- ACAS assessments, DISA STIG compliance, SCAP scanning, technical findings analysis, and remediation validation.
POA&M Management:
- Vulnerability documentation, remediation tracking, milestone management, risk acceptance support, and evidence validation.
Continuous Monitoring:
- Recurring security reviews, vulnerability tracking, cybersecurity posture assessment, and compliance reporting.
Security Control Analysis:
- Implementation validation, technical risk assessments, compliance evaluation, and corrective-action recommendations.
Enterprise Security:
- Windows, Linux, networking, system configurations, and enterprise cybersecurity concepts.
Technical Documentation:
- Accurate cybersecurity reporting, RMF artifact development, quality assurance, and technical briefings.
Certifications and DoD 8140 Compliance
- Must satisfy applicable DoD 8140 cybersecurity workforce qualification requirements for the assigned work role, proficiency level, and contract.
- Relevant certifications may include CompTIA Security+, CySA+, CASP+/SecurityX, CISSP, or other recognized qualifications.
- Additional operating-system, networking, vendor-specific, and cybersecurity certifications are preferred.
- Mandatory certifications, education, and experience requirements are determined by the applicable contract, labor category, and designated DoD 8140 work role.
Security Clearance and Installation Access
- Must meet applicable U.S. citizenship requirements established by the contract.
- Must possess or qualify for the required Government security clearance and maintain eligibility throughout employment.
- Must satisfy U.S. Army Aberdeen Proving Ground installation access, identity verification, and credentialing requirements.
- Must complete required Government cybersecurity awareness, acceptable-use, and security training.
- Must comply with applicable DoD, Army, ATEC, and installation security policies.
- Must maintain authorized access eligibility for assigned Government facilities, networks, and information systems.
Additional Employment Requirements - Must reside within commuting distance of Aberdeen Proving Ground, Maryland, or be willing to self-relocate.
- Must work full-time, on-site at the assigned Government installation.
- Must demonstrate professional conduct, accountability, effective teamwork, and adherence to established operational direction.
- Must independently validate technical work for accuracy, completeness, and compliance before submission.
Desired Qualifications: - Previous experience supporting U.S. Army, ATEC, NETCOM, or other DoD cybersecurity programs.
- Experience supporting enterprise information systems, network infrastructure, or mission-critical Government environments.
- Demonstrated ability to interpret and apply DISA STIG requirements and technical vulnerability assessment results.
- Experience supporting cybersecurity authorization or reauthorization efforts.
- Experience coordinating technical remediation activities with System Administrators and system engineering teams.
- Experience supporting Government inspections, cybersecurity assessments, or technical compliance reviews.
- Familiarity with enterprise vulnerability tracking, reporting dashboards, Microsoft Excel, Microsoft Lists, and other approved cybersecurity management tools.
- Experience developing technically defensible risk acceptance recommendations and supporting documentation.
