3+ years of experience in Assessment and Authorization (A&A) or Risk Management Framework (RMF) activities.
Familiarity with ICD 503 and government security policies.
Hands-on experience with Rapid7 Nexpose for vulnerability scanning and remediation.
Proficient in developing and maintaining security documentation like SSPs and POA&Ms.
Understanding of security control assessments and compliance processes.
Experience in systems analysis and project coordination.
Strong communication and organizational skills.
Responsibilities
Conduct security assessments to identify deviations from security configurations and policies.
Perform compliance audits and active vulnerability assessments.
Support the A&A process by maintaining security controls and tracking risk mitigation.
Develop and maintain security documentation and authorization artifacts.
Provide support for network and system accreditations and compliance requirements.
Apply Information Assurance (IA) and INFOSEC policies and standards.
Conduct security control assessments and recommend safeguards.
Benefits
Opportunity to work on national security missions.
Engagement with cutting-edge security technologies.
Collaborative work environment with diverse teams.
Professional development and training opportunities.
Full Job Description
Job Description
WarCollar Industries has an immediate opportunity for an experienced Assessment and Authorization (A&A) Specialist to support our customer and national security mission on the SKYNET contract in Herndon, VA. The A&A Specialist will support the assessment, authorization, and ongoing security compliance of classified information systems, networks, and enclaves. This individual will play a critical role in identifying security vulnerabilities, evaluating system configurations, mitigating risks, and ensuring compliance with applicable federal security requirements and government policies.
The ideal candidate will bring hands-on experience with the Risk Management Framework (RMF), ICD 503, security assessments, and vulnerability scanning, along with the ability to develop and maintain security documentation and support system accreditation activities.
Key Responsibilities
Conduct security assessments of information systems, networks, and enclaves to identify deviations from approved security configurations, organizational policies, and applicable government security standards.
Perform passive security evaluations, including compliance audits, and active assessments, including vulnerability scanning and security testing.
Support the Assessment and Authorization (A&A) process by establishing and maintaining security controls, tracking risk mitigation efforts, and facilitating system certification and accreditation.
Develop, review, and maintain security documentation, including System Security Plans (SSPs), Plans of Action and Milestones (POA&Ms), assessment reports, and supporting authorization artifacts.
Provide direct support for establishing and maintaining network and system accreditations, special approval authorizations, and security compliance requirements.
Apply applicable Information Assurance (IA) and Information Security (INFOSEC) policies and standards, including ICD 503, NIST, CNSS, and other U.S. Government security guidance.
Conduct security control assessments to validate established security requirements and recommend additional safeguards to strengthen system security postures.
Support formal Security Test and Evaluation (ST&E) activities, including pre-test preparation, test execution, results analysis, and preparation of required assessment reports.
Utilize vulnerability assessment tools, including Rapid7 Nexpose, to identify, analyze, document, and support remediation of security vulnerabilities.
Conduct periodic reviews of system security assessments, audits, and corrective actions to ensure identified deficiencies are properly addressed and closed.
Support security engineering activities, including system architecture reviews, requirements analysis, security requirements decomposition, and system performance testing and verification.
Provide day-to-day administration and technical guidance for information systems security programs, supporting security design, consultation, and implementation across customer initiatives.
Coordinate with system owners, engineers, security personnel, and government stakeholders to resolve security issues and maintain continuous authorization and compliance.
Required Skills
Minimum of 3 years of experience supporting Assessment and Authorization (A&A), Certification and Accreditation (C&A), or Risk Management Framework (RMF) activities.
Familiarity with ICD 503 and applicable government security policies, standards, and authorization requirements.
Hands-on experience with Rapid7 Nexpose vulnerability scanning, including reviewing scan results, identifying vulnerabilities, and supporting remediation efforts.
Demonstrated understanding of information systems security administration, security architecture, and technology implementation.
Experience developing, reviewing, and maintaining security documentation, including SSPs, POA&Ms, and security assessment reports.
Knowledge of security control assessments, vulnerability management, risk analysis, and security compliance processes.
Experience supporting systems analysis, systems integration, requirements analysis, process development, and project coordination.
Ability to provide technical guidance to system users and stakeholders on information systems security matters.
Strong written and verbal communication, organizational, interpersonal, and briefing skills.
Ability to manage multiple priorities and support moderately complex technical projects in a collaborative environment.
