Information Systems Security Engineer - SME

Lead and execute DOJ security authorization work using NIST RMF, serving as a senior technical authority across complex DOJ IT environments.

Responsibilities

• Lead, mentor, and supervise security professionals delivering end-to-end RMF lifecycle execution for DOJ information systems.
• Direct and coordinate activities in the Prepare step of RMF, maintaining clear roles, responsibilities, governance structures, and risk management strategies.
• Guide system categorization efforts to ensure proper classification based on mission impact, data sensitivity, and regulatory requirements.
• Direct selection, tailoring, and documentation of security controls aligned with system categorization, DOJ risk tolerance, and compliance requirements.
• Oversee implementation of technical, operational, and management controls across system and application lifecycles, ensuring deliverable quality, completeness, and consistency.
• Act as the senior technical authority for security architecture decisions, secure configurations, and remediation strategies.
• Ensure security control assessments are planned, executed, and documented to validate control effectiveness.
• Prepare and review risk management documentation supporting system authorization decisions and executive-level risk acceptance.
• Direct continuous monitoring and ongoing assessment activities, collecting metrics and trends to inform risk posture and adjust security strategies.
• Provide subject-matter expertise for cybersecurity risk analysis, incident response, vulnerability remediation, and audit support.
• Support OIG, FISMA, and internal review activities to keep systems audit-ready and defensible.
• Serve as a trusted technical advisor to DOJ leadership, system owners, ISSOs, and mission stakeholders.
• Track, report, and communicate security engineering status, risks, and improvement opportunities to Government and contractor leadership.
• Foster cross-division collaboration to ensure consistent application of security best practices.
• Promote security awareness through technical guidance, mentoring, and training.
• Maintain up-to-date knowledge of RMF, NIST guidance, DOJ policies, and industry best practices.
• Identify opportunities to improve RMF execution efficiency, consistency, and effectiveness through process refinement and approved tooling.

Requirements

• Senior-level experience providing security engineering leadership in federal or IC environments.
• Deep expertise in NIST RMF, FISMA, and federal authorization processes.
• Demonstrated experience supporting complex, enterprise-scale IT systems across multiple lifecycle stages.
• Proven ability to advise leadership on risk-based security decisions.
• Required Certification: CISSP.

Preferred / Highly Desired

• Prior experience supporting DOJ, or Intelligence Community customers.
• Experience working alongside ISSOs, AOs, and assessment teams in high-tempo environments.
• Familiarity with network, infrastructure, application, and SaaS security architectures.
• Experience supporting audit remediation and continuous monitoring programs.

RMF & SAA Program Leadership

• Lead, mentor, and supervise security professionals responsible for end-to-end RMF lifecycle execution for DOJ information systems.
• Coordinate RMF Prepare step activities, ensuring governance, roles, responsibilities, and risk management strategies are defined and maintained.
• Direct system categorization to ensure proper classification based on mission impact, data sensitivity, and regulatory requirements.

Security Engineering & Control Implementation

• Direct security control selection, tailoring, and documentation aligned to system categorizations, DOJ risk tolerance, and compliance requirements.
• Oversee implementation of technical, operational, and management controls across system and application lifecycles with consistent deliverables.
• Provide senior technical authority for security architecture decisions, secure configurations, and remediation strategies.

Assessment, Authorization & Continuous Monitoring

• Ensure security control assessments are planned, executed, and documented to validate control effectiveness.
• Prepare and review risk management documentation supporting authorization decisions and executive-level risk acceptance.
• Direct continuous monitoring and ongoing assessment, using metrics and trends to shape risk posture and security strategy updates.

Risk, Incident & Audit Support

• Provide subject-matter expertise for cybersecurity risk analysis, incident response, vulnerability remediation, and audit support.
• Support OIG, FISMA, and internal review activities so systems remain audit-ready and defensible.

Stakeholder Engagement & Reporting

• Serve as a trusted technical advisor to DOJ leadership, system owners, ISSOs, and mission stakeholders.
• Track, report, and communicate security engineering status, risks, and improvement opportunities to Government and contractor leadership.
• Coordinate with divisions to apply security best practices consistently.

Training & Continuous Improvement

• Promote security awareness via technical guidance, mentoring, and training.
• Keep current on RMF, NIST guidance, DOJ policies, and industry best practices.
• Drive RMF improvement opportunities through process refinement and approved tooling.

Technologies

• CISSP
• NIST Risk Management Framework (RMF)
• FISMA
• DOJ Security Assessment and Authorization (SAA) Program

Benefits

• Health Insurance
• Life Insurance
• Paid Time Off
• Holiday Pay
• short-term and long-term Disability
• Retirement
• Learning and Development opportunities
• other optional benefit elections