Fisma

Fisma Engineer Jobs

3 jobs found

Today

Cybersecurity Information System Security Engineer

LMI Detroit, MI

Detroit, MI

Today

$92k - $158k/yr Full time Authorization To Operate Cloud Cloud Platforms

Apply Now

Job Description

Join LMI as a Senior Cybersecurity Information Systems Security Engineer (ISSE) supporting the US Army Portfolio Acquisition Executive (PAE) Maneuver Ground office in Detroit, MI. This onsite role focuses on driving Risk Management Framework (RMF) execution to achieve and maintain Authority to Operate (ATO) approvals, pairing hands-on cybersecurity engineering with trusted advisory responsibilities across government and contractor teams.

Location: Detroit, MI (onsite)
Clearance: Active Secret clearance (minimum requirement)
Compensation: USD 92,075 - 158,138 per year

What you’ll do

Collaborate with system engineers, program managers, and Authorizing Officials (or their delegates) to define and implement system security requirements.
Lead continuous monitoring and verification of cybersecurity requirements across the system lifecycle.
Provide guidance and recommendations to government stakeholders and contractor teams as a trusted cybersecurity advisor.
Design, review, and refine system security architectures for cloud, on-premises, and hybrid environments.
Support RMF execution to achieve and maintain ATO approvals, including Interim Authority to Test (IATT) activities and related processes.
Identify, track, and mitigate security control gaps and non-compliance areas while ensuring alignment with applicable security standards.
Perform risk and vulnerability assessments, and develop and maintain critical documentation such as System Security Plans (SSPs).
Analyze and interpret security control deficiencies to evaluate their impact on enterprise risk and cybersecurity program effectiveness.
Partner with the Information System Security Manager (ISSM) and product teams to develop mitigations and prepare Program of Action and Milestones (POAMs) for ATO submission.
Guide system engineers in remediating vulnerability findings using state-of-the-art security scanning tools, DoD policies, and industry best practices.
Support cybersecurity engineering evaluation of alternatives, trade-offs, and risk treatment strategies.
Collaborate with cross-functional teams to deliver secure, dependable systems.
Develop and maintain dashboards to monitor platform controls, logs, and compliance status for reporting.
Apply NIST SP 800-53 Revision 4 or 5 security controls and NIST SP 800-53A security assessment procedures.

What you bring

Active SECRET clearance (minimum requirement).
Bachelor’s degree in Information Technology, Cybersecurity, Computer Science, Information Systems, Data Science, or Software Engineering from an ABET-accredited or NCAE-C designated institution.
5+ years of hands-on experience in system and/or security engineering within U.S. Government systems.
Practical experience working within government cloud platforms (examples include Azure, Amazon C2S, Commercial Cloud, or GovCloud), including secure security planning, design, and operations.
Proven ability to develop and maintain RMF documentation, including SSPs and POAMs.
Experience working with DoD technologies, systems, and command & control policies and procedures.
Hands-on experience using Enterprise Mission Assurance Support Service (eMASS) for compliance management and reporting.
Familiarity with federal IT security requirements, including DoD cyber regulations, FedRAMP, and FISMA compliance.
Knowledge of DoD STIGs, SRGs, and security requirements in NIST SP 800-53 and corresponding assessment procedures.
Strong communication and interpersonal skills with technical and non-technical stakeholders.
One or more certifications: GISF, Security+, CASP+, CSSP, Cloud+, CSSLP, GSEC, or a GSEC-equivalent. If not currently held, must obtain within the first 30 days of employment.

Tools and technologies

Azure, Amazon C2S, Commercial Cloud, GovCloud
Enterprise Mission Assurance Support Service (eMASS)
FedRAMP, FISMA
NIST SP 800-53, NIST SP 800-53A
DoD STIGs, SRGs
RMF, SSPs, POAMs, IATT

Core knowledge and skills

In-depth knowledge of computer networking concepts, protocols, and methodologies for network security.
Expertise in risk management processes to identify, assess, and mitigate risk.
Comprehensive understanding of laws, regulations, policies, and ethical standards impacting cybersecurity operations.
Strong grasp of cybersecurity principles and best practices for protecting information systems and data.
Awareness of cyber threats, vulnerabilities, and emerging attack vectors.
Understanding of how cybersecurity lapses impact systems, data integrity, and organizational objectives.
Knowledge of cloud service models including SaaS, IaaS, and PaaS.
Solid understanding of cloud deployment models (private, public, hybrid) and differences between on-premises and off-premises environments.

Preferred additional qualifications

Expertise in cloud security planning, design, and operations.
Experience with systems engineering lifecycle processes and Agile development methodologies.
Familiarity with CI/CD frameworks and DevSecOps practices.
Tactical military experience is strongly preferred.

View full job page →

21d ago

PROGRAM MANAGER – CYBERSECURITY ARCHITECTURE & ENGINEERING

Zermount Inc Arlington, VA

Arlington, VA

21d ago

$130k - $190k/yr Full time Manager Cloud Platforms Cloud Security Architecture

Apply Now

Job Description

Program Manager to lead a federal cybersecurity architecture and engineering delivery program across modernization, governance, and secure cloud engineering.

Responsibilities

Direct day-to-day execution of a federal cybersecurity architecture and engineering program, ensuring delivery is on schedule, within scope, and aligned with contract requirements.
Act as the primary interface across Government stakeholders, company leadership, technical teams, subcontractors, and mission partners.
Manage program scope, staffing, schedule, risks, issues, dependencies, action items, deliverables, and performance reporting.
Create and maintain program management artifacts, including Integrated Master Schedule (IMS), sprint plans, deliverable tracker, risk register, issue log, action item register, staffing tracker, and status reports.
Lead cross-functional teams supporting cybersecurity architecture, cloud security, RMF modernization, cATO, DevSecOps enablement, vulnerability management, continuous monitoring, and emerging technology or AI security testing.
Coordinate cybersecurity architecture recommendations and secure design patterns, including implementation roadmaps, SOPs, playbooks, dashboards, briefings, and customer-ready deliverables.
Support cATO implementation, including automated control assessment, control-to-evidence mapping, evidence collection, continuous monitoring, OSCAL-aligned documentation, metrics, dashboards, and authorization-support artifacts.
Oversee Emerging Technology and AI Security Engineering and Testing activities, including intake, triage, risk-tiering, evidence expectations, decision gates, testing coordination, and risk reporting.
Ensure emerging technology and AI assessments account for security, privacy, data protection, access control, supply chain risk, logging, monitoring, misuse risk, integration risk, and operational impact.
Facilitate Agile delivery, including backlog refinement, sprint planning, capacity planning, sprint reviews, retrospectives, and recurring team coordination.
Ensure work status is tracked in the Government-designated project management or Agile tracking tool.
Prepare and deliver program status updates, executive briefings, meeting minutes, technical summaries, risk reports, and deliverables for Government review.
Identify risks, blockers, staffing gaps, resource constraints, and quality concerns early, and recommend practical corrective actions.
Review deliverables for quality, accuracy, completeness, professionalism, and alignment with customer requirements prior to submission.
Support staffing, onboarding, knowledge transfer, team performance, and resource planning.
Drive a delivery culture focused on accountability, technical quality, customer service, compliance, and mission outcomes.
Perform additional/similar duties as assigned, including support across task areas, other programs/projects, as required by the Executive Team.

Requirements

8+ years of relevant experience supporting IT, cybersecurity, cloud, engineering, or federal technology programs.
5+ years of experience managing technical projects, cybersecurity projects, or federal IT/cybersecurity delivery teams.
Experience managing complex cybersecurity, cloud, enterprise IT, or security engineering programs in a federal contracting environment.
Experience managing program schedules, staffing, risks, issues, deliverables, status reporting, quality reviews, and client communications.
Working knowledge of RMF, ATO, cATO, FISMA, NIST guidance, security assessments, and federal cybersecurity requirements.
Experience coordinating technical teams across cybersecurity architecture, cloud security, infrastructure, application security, identity, DevSecOps, vulnerability management, GRC, or enterprise architecture workstreams.
Experience leading work in Agile environments (Scrum or Kanban), including backlog refinement, sprint planning, team coordination, and retrospectives.
Strong communication skills with senior Government stakeholders, technical teams, executives, and non-technical audiences.
Strong writing skills for status reports, meeting minutes, briefings, plans, procedures, and decision-support materials.
Strong organizational, analytical, problem-solving, and leadership skills.
Ability to manage multiple priorities, shifting deadlines, complex dependencies, and customer-facing issues.
Operate with sound judgment, personal accountability, professionalism, and limited supervision.

Technologies

RMF, ATO, cATO, FISMA, NIST SP 800-37, NIST SP 800-53, NIST SP 800-53A
AWS Security Hub, AWS Config, AWS GuardDuty, AWS CloudTrail, AWS CloudWatch, AWS IAM, AWS KMS, AWS Lambda
Azure Entra ID, Azure Key Vault, Azure Policy, Defender for Cloud, Azure Monitor, Log Analytics
DevSecOps, CI/CD, SBOM, SAST, DAST, SCA, IaC scanning, container security, SIEM/SOC
Okta, Microsoft Entra ID, CMDB, GRC, Zero Trust, SCRM, ICAM, SASE, CASB
TIC 3.0, OSCAL

Technical Knowledge

Cybersecurity architecture and security engineering
RMF, ATO, cATO, FISMA, NIST SP 800-37, NIST SP 800-53, and NIST SP 800-53A
Cloud security architecture, shared responsibility models, and hybrid or multi-cloud environments
AWS and Azure security services (Security Hub, Config, GuardDuty, CloudTrail, CloudWatch, IAM, KMS, Lambda; Entra ID, Key Vault, Azure Policy, Defender for Cloud, Monitor, Log Analytics, or similar)
DevSecOps, CI/CD security, automated security scanning, evidence automation, SBOM, SAST, DAST, SCA, IaC scanning, container security
Vulnerability management, configuration management, continuous monitoring, security telemetry, and SIEM/SOC integration
Identity, Credential, and Access Management (Okta, Microsoft Entra ID, or similar)
CMDB, asset inventory, GRC workflows, inherited controls, common controls, evidence repositories
Zero Trust, SCRM, ICAM, SASE, CASB, SWG, TIC 3.0, and enterprise security operations concepts
Emerging technology and AI security risk evaluation (intake, triage, testing, evidence collection, decision-support processes)

Preferred Qualifications

Experience supporting federal civilian, defense, intelligence, or highly regulated cybersecurity programs.
Experience managing cybersecurity architecture, cATO, RMF automation, GRC integration, cloud security modernization, or DevSecOps programs.
Experience with automated control assessment, control-to-evidence mapping, continuous monitoring dashboards, common controls, inherited controls, or OSCAL-aligned documentation.
Experience supporting AI, machine learning, generative AI, automation, or emerging technology security assessments.
Experience helping develop or manage intake forms, triage rubrics, risk-tiering models, testing playbooks, decision gates, or evidence requirements.
Experience with tools such as Microsoft Project, Rally, Microsoft 365, Confluence, ServiceNow, Archer, JCAM, RegScale, AWS Audit Manager, Tenable, Splunk, QRadar, Axonius, Prisma Cloud, Okta, Microsoft Defender, or similar platforms.

Certifications

PMP (required)
Agile/Scrum Master (required)
ITIL (preferred)
At least one of the following (required): CISSP; CISM; CISA; AWS, Azure, or GCP Solution Architect; or similar certification approved by Management

Clearance

Minimum of Public Trust

Work Location and Core Hours

Primary locations: Arlington and Alexandria, VA (onsite). Remote work authorized.
Occasional travel to primary locations required.
Hours: 6:00 am ET to 6:00 pm ET

Salary

USD 130,000 - 190,000 per year

View full job page →

2mo ago

Information Systems Security Engineer - SME

Agile Defense Washington, DC

Washington, DC

2mo ago Closed

$175k - $190k/yr Full time CISSP Doj Saa Program Fisma

This position is no longer accepting applications (closed Sep 11, 2026).

Job Description

Lead and execute DOJ security authorization work using NIST RMF, serving as a senior technical authority across complex DOJ IT environments.

Responsibilities

Lead, mentor, and supervise security professionals delivering end-to-end RMF lifecycle execution for DOJ information systems.
Direct and coordinate activities in the Prepare step of RMF, maintaining clear roles, responsibilities, governance structures, and risk management strategies.
Guide system categorization efforts to ensure proper classification based on mission impact, data sensitivity, and regulatory requirements.
Direct selection, tailoring, and documentation of security controls aligned with system categorization, DOJ risk tolerance, and compliance requirements.
Oversee implementation of technical, operational, and management controls across system and application lifecycles, ensuring deliverable quality, completeness, and consistency.
Act as the senior technical authority for security architecture decisions, secure configurations, and remediation strategies.
Ensure security control assessments are planned, executed, and documented to validate control effectiveness.
Prepare and review risk management documentation supporting system authorization decisions and executive-level risk acceptance.
Direct continuous monitoring and ongoing assessment activities, collecting metrics and trends to inform risk posture and adjust security strategies.
Provide subject-matter expertise for cybersecurity risk analysis, incident response, vulnerability remediation, and audit support.
Support OIG, FISMA, and internal review activities to keep systems audit-ready and defensible.
Serve as a trusted technical advisor to DOJ leadership, system owners, ISSOs, and mission stakeholders.
Track, report, and communicate security engineering status, risks, and improvement opportunities to Government and contractor leadership.
Foster cross-division collaboration to ensure consistent application of security best practices.
Promote security awareness through technical guidance, mentoring, and training.
Maintain up-to-date knowledge of RMF, NIST guidance, DOJ policies, and industry best practices.
Identify opportunities to improve RMF execution efficiency, consistency, and effectiveness through process refinement and approved tooling.

Requirements

Senior-level experience providing security engineering leadership in federal or IC environments.
Deep expertise in NIST RMF, FISMA, and federal authorization processes.
Demonstrated experience supporting complex, enterprise-scale IT systems across multiple lifecycle stages.
Proven ability to advise leadership on risk-based security decisions.
Required Certification: CISSP.

Preferred / Highly Desired

Prior experience supporting DOJ, or Intelligence Community customers.
Experience working alongside ISSOs, AOs, and assessment teams in high-tempo environments.
Familiarity with network, infrastructure, application, and SaaS security architectures.
Experience supporting audit remediation and continuous monitoring programs.

RMF & SAA Program Leadership

Lead, mentor, and supervise security professionals responsible for end-to-end RMF lifecycle execution for DOJ information systems.
Coordinate RMF Prepare step activities, ensuring governance, roles, responsibilities, and risk management strategies are defined and maintained.
Direct system categorization to ensure proper classification based on mission impact, data sensitivity, and regulatory requirements.

Security Engineering & Control Implementation

Direct security control selection, tailoring, and documentation aligned to system categorizations, DOJ risk tolerance, and compliance requirements.
Oversee implementation of technical, operational, and management controls across system and application lifecycles with consistent deliverables.
Provide senior technical authority for security architecture decisions, secure configurations, and remediation strategies.

Assessment, Authorization & Continuous Monitoring

Ensure security control assessments are planned, executed, and documented to validate control effectiveness.
Prepare and review risk management documentation supporting authorization decisions and executive-level risk acceptance.
Direct continuous monitoring and ongoing assessment, using metrics and trends to shape risk posture and security strategy updates.

Risk, Incident & Audit Support

Provide subject-matter expertise for cybersecurity risk analysis, incident response, vulnerability remediation, and audit support.
Support OIG, FISMA, and internal review activities so systems remain audit-ready and defensible.

Stakeholder Engagement & Reporting

Serve as a trusted technical advisor to DOJ leadership, system owners, ISSOs, and mission stakeholders.
Track, report, and communicate security engineering status, risks, and improvement opportunities to Government and contractor leadership.
Coordinate with divisions to apply security best practices consistently.

Training & Continuous Improvement

Promote security awareness via technical guidance, mentoring, and training.
Keep current on RMF, NIST guidance, DOJ policies, and industry best practices.
Drive RMF improvement opportunities through process refinement and approved tooling.

Technologies

CISSP
NIST Risk Management Framework (RMF)
FISMA
DOJ Security Assessment and Authorization (SAA) Program

Benefits

Health Insurance
Life Insurance
Paid Time Off
Holiday Pay
short-term and long-term Disability
Retirement
Learning and Development opportunities
other optional benefit elections

View full job page →

Fisma Engineer Jobs

Cybersecurity Information System Security Engineer

PROGRAM MANAGER – CYBERSECURITY ARCHITECTURE & ENGINEERING

Information Systems Security Engineer - SME

Get Fisma Engineer Jobs alerts