DoD Baseline Certification: IAT Level III or IAM Level III (e.g., CISSP, CISM, GSLC) required.
Active Top Secret clearance with SCI eligibility is mandatory.
8-10+ years of cybersecurity or information assurance experience in DoD or defense contractor environments.
Expertise in NIST SP 800-53 security controls and FISMA requirements is essential.
Hands-on experience with eMASS, ACAS, or automated SCAP compliance engines is necessary.
Strong technical writing skills for compiling System Security Plans and risk acceptance packages.
Responsibilities
Develop and refine agency-level cybersecurity policies and governance frameworks.
Lead comprehensive Risk Management Framework cycles for Assessment and Authorization activities.
Evaluate STIG scans and analyze vulnerability outputs to engineer mitigation strategies.
Collaborate with engineers to integrate advanced security controls into software and infrastructure.
Oversee tracking and closure of Plans of Action and Milestones across software segments.
Coordinate incident response efforts and after-action remediation following network vulnerabilities.
Facilitate technical exchange meetings and translate vulnerabilities into executive-level risk assessments.
Benefits
Opportunity to work within a fast-paced national security framework.
Engagement with senior agency executives and federal officials.
Involvement in shaping agency-level cybersecurity policies and strategies.
Collaboration with international technical teams on cybersecurity initiatives.
Full Job Description
SMS is seeking a Cybersecurity Specialist (SME) to provide high-level technical authority and critical advisory and assistance services (A&AS) in support of the Defense Threat Reduction Agency (DTRA). Operating within a fast-paced national security framework, the SME leads the development of agency-level cybersecurity policies, remediation plans, and countermeasures designed to protect sensitive and classified weapon systems, enterprise architectures, and foreign partner information systems from emerging global threats. This role acts as a primary technical advisor to system owners, authorizing officials, and senior agency executives to optimize compliance, perform vulnerability mitigations, and ensure continuous operational readiness.
Job Responsibilities
Policy & Strategy Development: Author and refine agency-level cybersecurity policies, standard operating procedures (SOPs), and governance frameworks aligned with Department of Defense (DoD), National Institute of Standards and Technology (NIST), and federal standards.
Risk Management Framework (RMF): Lead the execution of comprehensive RMF cycles to support Assessment and Authorization (A&A) activities, working directly to secure and maintain critical Authorizations to Operate (ATO) without operational lapses.
Lifecycle Security Engineering: Collaborate with system engineers and application developers to incorporate advanced security controls, cloud-native architecture principles, and defensive countermeasures into software and infrastructure baselines from inception.
POA&M Governance: Oversee the structural tracking, generation, and formal closure of Plans of Action and Milestones (POA&Ms) across designated software segments and technical mission components.
Incident Response Oversight: Coordinate technical tracking, situational awareness reports, and after-action remediation paths following detected network vulnerabilities or intrusion events.
Stakeholder Engagement: Facilitate strategic technical exchange meetings, translate highly complex technical vulnerabilities into executive-level risk determinations, and interface with federal agency officials and international technical teams.
Required Qualifications
DoD Baseline Certification: DoD 8140 / 8570 IAT Level III or IAM Level III baselines (e.g., CISSP, CISM, GSLC, or equivalent)
Must possess an active Top Secret clearance with SCI eligibility.
Core Technical Experience: 8-10+ years of dedicated cyber security or information assurance experience directly supporting Department of Defense or defense contractor environments.
Framework Mastery: Deep, demonstrable expertise working with NIST SP 800-53 security controls, FISMA requirements, and the complete RMF lifecycle.
Tool & Process Proficiency: Hands-on experience managing remediation tokens within eMASS, ACAS, or automated SCAP compliance engines.
Communication Metrics: Superior technical writing skills with direct experience compiling System Security Plans (SSP), Security Assessment Reports (SAR), and risk acceptance packages for senior government sign-off.
Education and Experience Requirements
Bachelor's Degree in Computer Science, Cybersecurity, Information Systems, or a related technology field paired with a minimum of 8 years of specialized engineering experience.
Master's Degree in a complementary technical discipline paired with a minimum of 6 years of high-level cyber operational or policy experience.
Equivalency Substitution: In lieu of a formal degree, 12+ years of specialized cybersecurity experience managing RMF pathways and advanced technical architecture within the defense sector may be considered.
