Note: The job is a remote job and is open to candidates in USA. Quivera Enterprises is seeking an experienced Security Engineer – Senior to support the Department of the Interior. This role provides senior-level cybersecurity engineering and Risk Management Framework support for enterprise information systems and involves conducting security assessments, developing security documentation, and ensuring compliance with federal cybersecurity requirements.
Responsibilities
- Conduct security assessments of federal information systems in accordance with NIST SP 800-37 and NIST SP 800-53 guidance
- Develop complete security authorization packages supporting Authority to Operate (ATO) and continuous authorization activities
- Perform system security categorization in accordance with NIST SP 800-60 and FIPS 199 requirements
- Document security control selection and tailoring in accordance with NIST SP 800-53 and NIST SP 800-18
- Develop and maintain System Security Plans (SSPs), Security Assessment Plans (SAPs), Security Assessment Reports (SARs), Risk Assessment Reports (RARs), Plans of Action and Milestones (POA&Ms), Contingency Plans (CPs), and supporting RMF documentation
- Support implementation of RMF activities throughout the System Development Life Cycle (SDLC)
- Conduct technical security assessments of complex information systems, network infrastructures, cloud environments, and industrial control systems with minimal supervision
- Evaluate management, operational, and technical security controls for effectiveness and compliance
- Perform vulnerability analysis and identify security weaknesses affecting federal information systems
- Apply NIST security engineering principles throughout system design, implementation, and operation
- Develop remediation recommendations and mitigation strategies for identified vulnerabilities
- Provide preliminary POA&M recommendations supporting corrective action planning
- Conduct concurrent risk assessments and document findings within Security Assessment Reports
- Support Indian Affairs Risk Management Framework and Continuous Monitoring Programs
- Monitor implementation of security controls to ensure ongoing compliance with federal cybersecurity requirements
- Participate in continuous assessment of technical, operational, and management controls
- Assist with ongoing authorization activities and security documentation updates
- Support compliance with FISMA, Departmental policy, and organizational cybersecurity standards
- Develop initial and updated System Security Plans
- Develop Contingency Plans aligned with NIST SP 800-34 guidance
- Prepare Security Assessment Plans and execute assessment activities
- Develop Security Assessment Reports documenting assessment findings
- Prepare Risk Assessment Reports identifying organizational and system risks
- Develop and maintain POA&M documentation identifying weaknesses, remediation activities, and risk priorities
- Maintain documentation supporting system authorization and continuous monitoring
- Perform enterprise and system-level risk assessments
- Analyze vulnerabilities, threats, likelihood, and impact to determine organizational risk
- Provide risk mitigation recommendations aligned with NIST guidance and industry best practices
- Evaluate configuration management processes supporting secure system operation
- Support contingency planning and disaster recovery planning activities
- Collaborate with Information System Owners, Information System Security Officers, developers, project teams, and IT operations personnel
- Coordinate assessment activities with organizational stakeholders while working independently
- Provide technical guidance regarding security engineering and RMF implementation
- Support implementation of cybersecurity best practices across the enterprise
- Assist organizational stakeholders in understanding security assessment findings and remediation priorities
- Provide multidisciplinary security support across: Physical Security, Computer Security, Personnel Security, Information Security, Administrative Security, Operational Security, Communications Security
- Support strategic implementation of security controls across enterprise information systems
- Participate in process improvement initiatives supporting cybersecurity maturity
- Maintain awareness of emerging cybersecurity threats, technologies, and federal regulatory changes
Skills
- Bachelor's degree and four (4) years of relevant professional experience; or
- Master's degree and three (3) years of relevant professional experience; or
- Six (6) years of directly related professional experience in lieu of a degree
- Experience supporting Risk Management Framework (RMF) activities
- Experience conducting technical security assessments
- Experience developing complete security authorization packages
- Experience with information assurance or cybersecurity engineering
- Experience implementing NIST RMF guidance
- Experience conducting security assessments of complex information systems with minimal supervision
- Experience performing vulnerability assessments and risk analysis
- Experience developing POA&Ms and remediation recommendations
- Experience supporting continuous monitoring activities
- Experience evaluating management, operational, and technical security controls
- NIST SP 800-37 Risk Management Framework
- NIST SP 800-53 Security Controls
- NIST SP 800-18 System Security Plans
- NIST SP 800-34 Contingency Planning
- NIST SP 800-27 Security Engineering
- NIST SP 800-60 Information Categorization
- FIPS 199
- Risk Assessment & Management
- Vulnerability Analysis
- Configuration Management
- Disaster Recovery
- Contingency Planning
- Security Engineering
- Authorization & Assessment (A&A)
- Security Authorization Packages
- Continuous Monitoring
- Federal Information Security Modernization Act (FISMA)
- CISSP
- CAP (Certified Authorization Professional)
- Security+
- CASP+
- CISM
- CEH
- GSEC
- Experience supporting Department of the Interior or Bureau of Indian Affairs
- Experience with eMASS, CSAM, Xacta, Archer, or similar GRC platforms
- Experience supporting cloud security and FedRAMP initiatives
- Experience with industrial control systems (ICS) or operational technology (OT) environments
Company Overview