Information Assurance and Security Engineer

• Minimum of 8 years with BS/BA; Minimum of 6 years with MS/MA; Minimum of 3 years with PhD, 12 years with HS diploma • Ability to obtain and maintain DOD Public Trust • Hands-on experience with the DoD Risk Management Framework (RMF) and associated tooling, specifically eMASS (Enterprise Mission Assurance Support Service). • In-depth knowledge of NIST SP 800-53 Rev 5, NIST SP 800-37, NIST SP 800-171 Rev 2, NIST SP 800-137, FISMA, DoDI 8510.01, and DoDI 8500.01. • Experience conducting vulnerability assessments, developing POA&Ms, and managing the full A&A lifecycle including ATO package development. • Experience with application security scanning tools including Fortify, Sonatype, and BURP; familiarity with OWASP secure coding practices. • Working knowledge of STIG compliance verification, checklist preparation, and remediation. • Demonstrated experience supporting DevSecOps security practices within Agile development environments. • DoD 8140.03 / DoD 8570.01-M compliant certification IAT/IAM Level II (e.g., CISSP, CASP+, CEH, Security+, or equivalent certification). Preferred Qualifications • Active Public Trust clearance. • CISSP (Certified Information Systems Security Professional) or equivalent advanced certification. • Experience with cloud security at FedRAMP Moderate, DISA IL-4, or DISA IL-5 authorization levels; familiarity with Oracle Cloud Infrastructure (OCI) security configuration. • Familiarity with CMMC (Cybersecurity Maturity Model Certification) framework and compliance. • Experience supporting external DoD financial/operational audits (FIAR, ICOFR, FISCAM). • Working knowledge of ServiceNow, JIRA, and SharePoint in an ITSM/project context. • Knowledge of DFARS 252.204-7012 cyber incident reporting requirements. • Experience implementing cyberspace tasking orders (CTOs) from JFHQ-DODIN or USCYBERCOM. • Prior experience in the S-ISSO role within a large-scale DoD program environment Peraton is seeking a Information Assurance and Security Engineer. The position will be responsible for the following but not limited too: This position is remote • Provide technical and programmatic information assurance services to internal and external customers in support of network and information security systems across the DEERS application portfolio. • Design, develop, and implement security requirements within the organization's business processes, including DevSecOps pipelines, cloud migration activities (OCI), and Agile development sprints. • Prepare and maintain security documentation using accepted DoD and NIST guidelines, including System Security Plans (SSPs), Security Assessment Reports (SARs), Plans of Action and Milestones (POA&Ms), STIG checklists, and implementation plans within eMASS. • Prepare Security Test and Evaluation (ST&E) plans and support execution of formal security assessments in coordination with the DMDC Cybersecurity Division (CSD) and Enterprise ISSOs. • Provide Certification and Accreditation (C&A) / Assessment and Authorization (A&A) support, including development of security and contingency plans, in alignment with DoDI 8510.01 and NIST SP 800-37 RMF principles. • Conduct complex risk and vulnerability assessments; develop and maintain risk mitigation strategies addressing identified weaknesses across the DEERS application environment. • Analyze organizational policies and procedures against Federal laws and regulations — including FISMA, NIST SP 800-53 Rev 5, DoDI 8500.01, and OMB M-14-03 — and provide recommendations for closing identified compliance gaps. • Recommend and implement system enhancements to improve security deficiencies; support IAVA (Information Assurance Vulnerability Alert) monitoring and monthly resolution activities. • Develop, test, and integrate computer and network security tools, including Fortify, Sonatype, and BURP scanning solutions; integrate security scanning into the DevSecOps pipeline for every production release. • Secure system configurations and install security tools; scan systems to determine compliance against STIG and NIST SP 800-53 Rev 5 baselines; report results and evaluate products and system administration configurations. • Conduct security program audits and develop solutions to address identified risks; support 1–3 external audits annually (e.g., DHA MERHCF, DoD CIO ICOFR, FIAR). • Provide IA support for the development and implementation of security architectures to meet new and evolving security requirements, including support for OCI cloud migration at DISA IL-4/IL-5 authorization levels. • Provide assistance in computer incident investigations; report cyber incidents within 1 hour of discovery per DFARS 252.204-7012 and DMDC IR Team protocols, with follow-up reporting every 24 hours until closure. • Perform vulnerability assessments including development of risk mitigation strategies; submit POA&Ms within 3 business days of Category 1 or 2 vulnerability identification and update within 10 business days of vulnerability events. • Support Information Security Continuous Monitoring (ISCM) activities per NIST SP 800-137/137A, DoDI 8530.01, and DoDI 8531.01, and report weekly vulnerability scan status during Integrated Progress Reviews (IPRs). • Maintain and support the program's ATOs and A&I packages through the full RMF lifecycle — Prepare, Categorize, Select, Implement, Assess, Authorize, and Monitor. • Implement JFHQ-DODIN and USCYBERCOM Cyberspace Tasking Orders (CTOs) as directed. • Ensure all cybersecurity workforce personnel are identified, screened, trained, and certified in accordance with DoD 8140.03 and CMMC (DFARS 252.204-7021) requirements. • Conduct and support mandatory security training including OPSEC, CUI Handling, Insider Threat, Privacy Act/PII, IT Security Awareness, Counterintelligence, Antiterrorism Level I, and Records Management.