Note: The job is a remote job and is open to candidates in USA. Peraton is a national security and enterprise IT company providing mission-critical solutions across defense and government environments. The Information Assurance and Security Engineer provides information assurance, cybersecurity, risk management, compliance, vulnerability assessment, RMF, DevSecOps, cloud security, audit, incident response, and security training support for the DEERS application portfolio.
Responsibilities
- Provide technical and programmatic information assurance services to internal and external customers in support of network and information security systems across the DEERS application portfolio
- Design, develop, and implement security requirements within the organization's business processes, including DevSecOps pipelines, cloud migration activities (OCI), and Agile development sprints
- Prepare and maintain security documentation using accepted DoD and NIST guidelines, including System Security Plans (SSPs), Security Assessment Reports (SARs), Plans of Action and Milestones (POA&Ms), STIG checklists, and implementation plans within eMASS
- Prepare Security Test and Evaluation (ST&E) plans and support execution of formal security assessments in coordination with the DMDC Cybersecurity Division (CSD) and Enterprise ISSOs
- Provide Certification and Accreditation (C&A) / Assessment and Authorization (A&A) support, including development of security and contingency plans, in alignment with DoDI 8510.01 and NIST SP 800-37 RMF principles
- Conduct complex risk and vulnerability assessments; develop and maintain risk mitigation strategies addressing identified weaknesses across the DEERS application environment
- Analyze organizational policies and procedures against Federal laws and regulations - including FISMA, NIST SP 800-53 Rev 5, DoDI 8500.01, and OMB M-14-03 - and provide recommendations for closing identified compliance gaps
- Recommend and implement system enhancements to improve security deficiencies; support IAVA (Information Assurance Vulnerability Alert) monitoring and monthly resolution activities
- Develop, test, and integrate computer and network security tools, including Fortify, Sonatype, and BURP scanning solutions; integrate security scanning into the DevSecOps pipeline for every production release
- Secure system configurations and install security tools; scan systems to determine compliance against STIG and NIST SP 800-53 Rev 5 baselines; report results and evaluate products and system administration configurations
- Conduct security program audits and develop solutions to address identified risks; support 1-3 external audits annually (e.g., DHA MERHCF, DoD CIO ICOFR, FIAR)
- Provide IA support for the development and implementation of security architectures to meet new and evolving security requirements, including support for OCI cloud migration at DISA IL-4/IL-5 authorization levels
- Provide assistance in computer incident investigations; report cyber incidents within 1 hour of discovery per DFARS 252.204-7012 and DMDC IR Team protocols, with follow-up reporting every 24 hours until closure
- Perform vulnerability assessments including development of risk mitigation strategies; submit POA&Ms within 3 business days of Category 1 or 2 vulnerability identification and update within 10 business days of vulnerability events
- Support Information Security Continuous Monitoring (ISCM) activities per NIST SP 800-137/137A, DoDI 8530.01, and DoDI 8531.01, and report weekly vulnerability scan status during Integrated Progress Reviews (IPRs)
- Maintain and support the program's ATOs and A&I packages through the full RMF lifecycle - Prepare, Categorize, Select, Implement, Assess, Authorize, and Monitor
- Implement JFHQ-DODIN and USCYBERCOM Cyberspace Tasking Orders (CTOs) as directed
- Ensure all cybersecurity workforce personnel are identified, screened, trained, and certified in accordance with DoD 8140.03 and CMMC (DFARS 252.204-7021) requirements
- Conduct and support mandatory security training including OPSEC, CUI Handling, Insider Threat, Privacy Act/PII, IT Security Awareness, Counterintelligence, Antiterrorism Level I, and Records Management
Skills
- Minimum of 8 years with BS/BA; Minimum of 6 years with MS/MA; Minimum of 3 years with PhD, 12 years with HS diploma
- Ability to obtain and maintain DOD Public Trust
- Hands-on experience with the DoD Risk Management Framework (RMF) and associated tooling, specifically eMASS (Enterprise Mission Assurance Support Service)
- In-depth knowledge of NIST SP 800-53 Rev 5, NIST SP 800-37, NIST SP 800-171 Rev 2, NIST SP 800-137, FISMA, DoDI 8510.01, and DoDI 8500.01
- Experience conducting vulnerability assessments, developing POA&Ms, and managing the full A&A lifecycle including ATO package development
- Experience with application security scanning tools including Fortify, Sonatype, and BURP; familiarity with OWASP secure coding practices
- Working knowledge of STIG compliance verification, checklist preparation, and remediation
- Demonstrated experience supporting DevSecOps security practices within Agile development environments
- DoD 8140.03 / DoD 8570.01-M compliant certification IAT/IAM Level II (e.g., CISSP, CASP+, CEH, Security+, or equivalent certification)
- Active Public Trust clearance
- CISSP (Certified Information Systems Security Professional) or equivalent advanced certification
- Experience with cloud security at FedRAMP Moderate, DISA IL-4, or DISA IL-5 authorization levels; familiarity with Oracle Cloud Infrastructure (OCI) security configuration
- Familiarity with CMMC (Cybersecurity Maturity Model Certification) framework and compliance
- Experience supporting external DoD financial/operational audits (FIAR, ICOFR, FISCAM)
- Working knowledge of ServiceNow, JIRA, and SharePoint in an ITSM/project context
- Knowledge of DFARS 252.204-7012 cyber incident reporting requirements
- Experience implementing cyberspace tasking orders (CTOs) from JFHQ-DODIN or USCYBERCOM
- Prior experience in the S-ISSO role within a large-scale DoD program environment
Benefits
- Eligible employees may receive medical, dental, and vision benefits.
- Life insurance.
- Health savings account.
- Short-term and long-term disability.
- Employee Assistance Program (EAP).
- Parental leave.
- 401(k).
- Paid time off (PTO) for vacation.
- Company-paid holidays.
- Employees may be eligible for overtime, shift differential, and a discretionary bonus in addition to base pay.
Company Overview
Company H1B Sponsorship