Tharros is seeking an experience Information System Security Engineer to support cybersecurity, Risk Management Framework (RMF), and Authority to Operate (ATO) activities for DoD/federal information systems. The ISSE will work closely with ISSOs, ISSMs, system owners, security teams, engineers, and government stakeholders to prepare, manage, and submit security documentation and support systems throughout the RMF/ATO lifecycle. The ideal candidate is a hands-on cybersecurity professional who can take ownership of RMF and ATO activities, develop and maintain a complete authorization package, work effectively in eMASS, coordinate with ISSOs/ISSMs and engineering teams, and drive security findings toward resolution.
- Support the implementation and execution of the NIST Risk Management Framework (RMF).
- Develop, review, and maintain RMF security documentation and artifacts.
- Prepare, coordinate, and support Authority to Operate (ATO) packages and submissions.
- Work within eMASS to create, update, and maintain system security artifacts.
- Support security control implementation, assessment, validation, and remediation activities.
- Develop and maintain System Security Plans (SSPs), Security Assessment Reports (SARs), Plans of Action and Milestones (POA&Ms), and supporting documentation.
- Collect and maintain security control implementation evidence.
- Coordinate with ISSOs, ISSMs, system owners, security control assessors, engineers, and government stakeholders.
- Track security findings, vulnerabilities, and POA&M items through resolution.
- Support DISA STIG/SRG compliance and vulnerability remediation activities.
- Participate in RMF reviews, security assessments, authorization activities, and ATO decision processes.
- Ensure security documentation and system security artifacts remain accurate, current, and audit-ready.
- Provide cybersecurity and RMF guidance to engineering and project teams.
- Active TS/SCI security clearance required.
- DoD IAT Level II certification required, such as Security+ or another DoD-approved IAT Level II baseline certification.
- Demonstrated experience as an ISSE, Security Engineer, ISSO, or similar cybersecurity professional.
- Hands-on experience with the NIST RMF and ATO lifecycle.
- Experience preparing and supporting ATO submissions.
- Hands-on experience with eMASS.
- Working knowledge of NIST SP 800-53 security controls.
- Experience developing and maintaining SSPs, SARs, POA&Ms, security control evidence, and other RMF artifacts.
- Experience with DISA STIGs/SRGs and vulnerability management.
