The Office of the Chief Information Officer (OCIO) advances the Department of Energy’s (DOE) mission by establishing enterprise-wide policy, standards, and services that ensure secure, reliable, and innovative information technology (IT) delivery across the Department. The OCIO is committed to strengthening DOE’s cybersecurity posture, improving IT service performance, and ensuring the protection of the Department’s systems, networks, and data while maintaining responsible stewardship of taxpayer resources. To join our team of outstanding professionals, apply today!
The Assessment and Authorization Team Lead is a subject matter expert who supports this mission by leading cybersecurity measures, assessing security controls, evaluating system risks, and leading efforts to respond to cybersecurity data calls, research, and analysis. This role combinesdeep experience and understanding of cybersecurity functions, Assessment & Authorization (A&A), and oversight and compliance responsibilities, ensuring DOE systemsremaincompliant, secure, and resilient.
Responsibilities
- Provide technical knowledge and analysis of all areas related to A&A and lead all phases of the Risk Management Framework with emphasis on the planning, analysis, testing, integration, documentation, and presentation phases.
- Analyzes, resolves, and reports on all issues to ensure that projects remain on schedule and within budget. Prepares and delivers presentations and briefings as required during A&A, risk analysis, and vulnerability review efforts.
- Serve as the subject matter expert, possessing in-depth knowledge of all aspects of A&A and risk management such as security and privacy controls, implementation of new and emerging trends in the industry, and process improvement initiatives (i.e., Cloud security, Ongoing Authorization, NIST SP 800-53 Rev. 5, Rapid ATO, etc.).
- Provides technical knowledge, analysis, direction, and guidance of all difficult or unusual problems as related to A&A.
- As a lead subject matter expert, applies principles, methods, and knowledge of A&A to specific task order requirements, advanced mathematical principles, and methods to exceptionally difficult and narrowly defined technical problems in engineering and other scientific applications to arrive at automated solutions.
- Conducts briefings to Federal Leadership and possesses and applies subject matter expertise across key tasks and high-impact assignments.
- Serves as a technical expert across multiple project assignments.
Assessment and Authorization Team Lead Duties:
- Perform assessments of existing and new NIST and FISMA systems, including subsystems within respective system boundaries, communicate results, articulate potential implications of identified control weaknesses, and work to document through artifacts and documentation.
- Lead, mentor, and guide a team of cybersecurity professionals, including Assessors, Security Assessment Team (SAT), Continuous Monitoring Team (ConMon), and DOR FedRAMP Team.
- Lead reviews and analysis of findings packages outlining identified findings, weaknesses, remediation, and provide guidance during meeting reviews.
- Lead reviews and analysis of significant system change requests, deviation requests, and provide guidance and oversight of potential system security impacts.
- Conduct final quality assurance reviews of security packages, including System Security Plans and Risk Assessments, before submission to the Authorizing Official.
- Establish schedules, manage milestones, and coordinate remediation activities, including Plans of Action and Milestones (POA&Ms).
- Establish and maintain strong relationships with a team of cybersecurity professionals, including Information System Security Officers (ISSOs), System Owners (SOs), Technical Points of Contact (TPOCs), and Security Control Assessors (SCAs).
- Provide oversight when responding to security-and system-related data calls for internal and external audits such as FISMA and data calls as requested.
- Act as the primary liaison among operational security teams, third-party system owners, contractors, government, and federal executive leadership.
Qualifications
- Bachelor’s Degree orfour (4) years of equivalent work experience.
- 10+ years of experience in cybersecurity operations, security control assessments, or related technical security functions.
- Experience leading teams in assessing and determining control applicability, including inherited, hybrid, and independent (standalone) controls in both cloud and non-cloud environments.
- Lead and provide oversight for conducting detailed reviews of controls and technical security control testing across each component type, including the development of security and privacy assessment plans.
- Demonstrates expert knowledge of each phase of the RMF process, along with a strong understanding of the security and privacy controls outlined in NIST Special Publication 800-53, the NIST Cybersecurity Framework, and other information security and privacy laws and regulations.
- Demonstrated ability to lead, engage with, and analyze information system configurations and technical specifications in accordance with NIST SP 800-53 and applicable overlays.
- Ability to work independently with assessment, external, and government teams, addressing issues as necessary to remove obstacles and barriers and achieve successful outcomes.
- Demonstrates strong written and verbal communication skills in preparing, presenting, and defending security documentation, assessment reports, findings, and outcomes.
- Ability to complete a DOE background investigation and obtain federal government clearance for access to federal systems.
- Ability to obtain DOE L clearance.
- Any clearance requirements for this position are established by the government contract.
Benefits InformationRegular - The company offers a comprehensive benefits program, including medical, dental, vision, life insurance, 401(k) and a range of other voluntary benefits. Paid Time Off (PTO) is offered to regular full-time and part-time employees.
Pay Range$160,000 - $170,000
Job ID2026-26052
Work TypeRemote
