Information Assurance Specialist IV

We are an employee-centric company that truly values our team members and the contributions they make to our customers and the missions they support. We pride ourselves on being forward-leaning thinkers and on building teams that are and continue to be technically proficient across a broad range of cyber mission areas. OneZero full-time employees receive a highly competitive benefits package including health dental vision and life insurance a 401(k) with company matching paid time off and holidays an employee referral program and educational assistance. Additional details are available on our website: Title: Information Assurance Specialist IV

Location: Arlington VA or Mechanicsburg PA

Clearance: Secret

Job Summary:

The Information Assurance Specialist IV is key personnel providing senior Information System Security Officer (ISSO) Security Control Assessor (SCA) and Security Controls Validator (SCA-V) support across DSCAs five IM&T. The role ensures the confidentiality integrity and availability of data on assigned systems leads operationalization of RMF/CSRMC in a cloud-native DevSecOps environment and drives automation of control implementation evidence collection and authorization artifacts in support of A&A Assess Only and continuous ATO (cATO) outcomes.

Education and Experience:

• Bachelors degree from an accredited institution in Information Technology Computer Science Engineering or a related technical discipline.
• Current DoW 8570/8140 certification meeting the IAM Level II or IAT Level II baseline requirement (e.g. CISSP Security CE CISM CASP CE).
• Five (5) years of dedicated Information Assurance experience with at least three (3) of those years being consecutive.
• Three (3) consecutive years directly relevant to the tasks above demonstrating a hands-on understanding of the DoW cybersecurity environment.
• Active Secret clearance; U.S. citizenship required.

Essential Duties:

• Serving as ISSO for assigned DSCA IM&T portfolio systems ensuring confidentiality integrity and availability of data residing on or transiting those systems.
• Leading operationalization of the RMF/Cybersecurity Risk Management Construct (CSRMC) within a cloud-native DevSecOps framework and automating security control implementation and evidence collection to achieve and maintain A&A Assess Only and cATO accreditations.
• Proactively identifying and mitigating security weaknesses and maintaining accurate current security documentation.
• Developing the Security Assessment Plan (SAP) and conducting ongoing assessments of security controls beyond periodic compliance checks.
• Providing actionable risk analysis that prioritizes vulnerabilities and control deficiencies and interpreting and validating outputs of automated validation tools and Policy-as-Code scripts.
• Developing and maintaining key authorization artifacts including the Security Assessment Report (SAR) the Authorization Recommendation Memo and the programs overarching ATO documentation.
• Performing SCA-V duties: validating security and compliance content assessing CaC profiles and scripts and verifying that automated compliance evidence is correctly ingested and reflected.
• Maintaining the eMASS record as the system of record documenting all assessment activities findings and evidence in a timely and accurate manner.
• Performing in-depth risk analysis and POA&M support and providing written recommendations for mitigation and validation of proposed corrective actions.
• Preparing and assembling the Security Authorization Package and briefing the SCA ISSM and other stakeholders on assessment results and residual risk.

Knowledge Skill and Abilities:

• Expert knowledge of RMF NIST SP 800-53 DISA STIGs and the Cybersecurity Risk Management Construct (CSRMC).
• Master-level proficiency in eMASS as the authoritative system of record for assessment and authorization data.
• Familiarity with FedRAMP DoW Impact Levels and the DoW Cloud Computing Security Requirements Guide (CCSRG).
• Hands-on experience securing AWS cloud-native architectures and authorized SaaS solutions.
• Ability to review and validate Compliance-as-Code (CaC) and Policy-as-Code (PaC) profiles scripts and automated compliance evidence.
• Skill in risk analysis POA&M development and drafting decision-quality authorization documentation (SAP SAR Authorization Recommendation Memo).

Clear no-surprises reporting and effective collaboration with system owners ISSMs

OneZero Solutions LLC is an Equal Opportunity employer. All qualified applicants will receive consideration for employment without regard to race color religion sex sexual orientation gender identity national origin age pregnancy genetic information disability status as a protected veteran or any other protected category under applicable federal state and local laws.

To request an accommodation please contact us at or call .

Required Experience:

IC