Scap & Stig Engineer Jobs

1 job found

Today

Cybersecurity Engineer - DoD RMF & Authorization

Fuse Integration San Diego, CA

San Diego, CA

Today

$120k - $160k/yr Full time Ato/iatt Cybersecurity Tools Dod Rmf

Apply Now

Job Description

Fuse Integration is seeking a Cybersecurity Engineer to support secure communications networks for U.S. defense agencies through DoD Risk Management Framework (RMF) execution and authorization package development. The role will lead hands-on RMF work across development, testing, authorization, and operational lifecycles, ensuring documentation, assessments, and continuous monitoring stay current in the eMASS environment.

This onsite position is located in San Diego, CA and requires 6+ years of professional experience, including DoD cybersecurity and RMF authorization support.

Responsibilities

Lead and support execution of the Department of Defense (DoD) Risk Management Framework (RMF) across development, testing, authorization, and operational lifecycle activities.
Develop, maintain, and manage complete RMF authorization packages supporting Authorizations to Operate (ATOs), Interim Authorizations to Test (IATTs), and ongoing authorization actions.
Prepare and maintain RMF artifacts including System Security Plans (SSPs), security control implementation statements, Plans of Action and Milestones (POA&Ms), hardware and software inventories, and system architecture documentation.
Manage RMF authorization packages within Enterprise Mission Assurance Support Service (eMASS), ensuring security control documentation and assessment evidence remain accurate, complete, and maintained.
Analyze security control implementations according to NIST SP 800-53, DoDI 8510.01, CNSSI 1253, applicable DISA Security Technical Implementation Guides (STIGs), and DoD cybersecurity policies.
Coordinate with ISSMs, ISSOs, SCAs, AOs, and government representatives to support security assessments and authorization decisions.
Evaluate system architectures, configurations, and operating environments to determine security control applicability, implementation approaches, and compliance needs.
Review and document vulnerability assessment results from ACAS, Nessus, SCAP, and STIG compliance assessments to identify security deficiencies, document associated risks, and recommend remediation.
Develop, maintain, and track POA&Ms, coordinating with engineering teams to resolve vulnerabilities, document mitigating factors, and support risk acceptance decisions.
Support Security Control Assessment (SCA) activities by preparing evidence, responding to findings, coordinating technical demonstrations, and addressing documentation deficiencies.
Develop and execute continuous monitoring activities to maintain cybersecurity posture and authorization status.
Assess system modifications, software updates, and configuration changes for their impact on security controls, authorization boundaries, and existing ATO/IATT conditions.
Partner with systems, software, and network engineers to ensure cybersecurity requirements are integrated into design, development, integration, and testing.
Provide technical guidance on secure configurations, operating system hardening, network security, virtualization, and vulnerability remediation aligned to DoD cybersecurity requirements.

Requirements

6–8 years of professional experience in DoD cybersecurity, information assurance, systems administration, network engineering, or related disciplines.
Experience supporting DoD RMF authorization activities, including development and maintenance of ATO and/or IATT packages.
Hands-on experience creating and maintaining RMF documentation such as SSPs, security control implementation statements, POA&Ms, and supporting assessment artifacts.
Experience using eMASS to document security controls, manage authorization artifacts, track assessment findings, and maintain RMF packages.
Strong working knowledge of NIST SP 800-53, DoD RMF requirements, and security control implementation and assessment methodologies.
Experience interpreting DISA STIG requirements and vulnerability assessment results to determine compliance and develop remediation recommendations.
Experience reviewing technical system configurations, network architectures, and security control implementations to support accurate RMF documentation.
Working knowledge of Linux and Windows including system administration, security hardening, access controls, and configuration management.
Familiarity with virtualization environments such as VMware, KVM, or Hyper-V.
Networking fundamentals knowledge including TCP/IP, VLANs, subnets, firewalls, routing, network segmentation, and secure communications.
Ability to analyze findings, document technical risks, and communicate remediation requirements to engineering teams and government stakeholders.
Strong technical writing skills for clear, accurate, and technically defensible security documentation.
Ability to independently manage multiple RMF deliverables and coordinate across engineering disciplines to meet program authorization milestones.
Ability to meet applicable DoD 8140 cybersecurity workforce qualification requirements for the assigned role.
U.S. citizenship and an Active Secret security clearance.

Technologies

Linux, Windows, VMware, KVM, Hyper-V
eMASS, ACAS, Nessus, SCAP, STIGs
TCP/IP, VLANs, firewalls
POA&Ms, System Security Plans (SSPs)
NIST SP 800-53, DoDI 8510.01, CNSSI 1253, DISA STIGs
DoD RMF, DoD 8140

Benefits

Medical, Dental, and Vision
Employee coverage fully funded; a portion of dependents’ coverage funded as well
11 paid Federal Holidays
Paid Time Off (PTO)
40 hours of paid sick leave per year
401k with employer matching
Annual bonuses
Cell phone reimbursement: $100/month

Preferred Qualifications

Experience independently managing DoD RMF authorization packages from initial system categorization through authorization and continuous monitoring.
Experience supporting successful ATO/IATT submissions, security assessments, and authorization package reviews.
Familiarity with Navy, Marine Corps, or Air Force RMF authorization processes and service-specific requirements.
Experience supporting cybersecurity accreditation of RDT&E systems, developmental systems, or operational DoD capabilities.
Experience coordinating directly with SCAs, AOs, government ISSMs, and other authorization stakeholders.
Experience performing security control inheritance analysis, developing system authorization boundaries, and identifying applicable overlays and control tailoring requirements.
Experience using ACAS, Nessus, SCAP, STIG Viewer, and other vulnerability assessment or compliance tools.
Experience with technical implementation of DISA STIGs and security hardening of Linux, Windows, networking equipment, and virtualized environments.
Familiarity with DoDI 8510.01, NIST SP 800-37, CNSSI 1253, and applicable DoD continuous monitoring guidance.
Knowledge of Navy C4ISR systems, military networks, or tactical data links.
Experience supporting cybersecurity requirements within Agile software development or systems engineering environments.
Experience assessing cybersecurity risks associated with custom software, specialized hardware, or mission-specific system architectures.

Salary: USD 120,000 - 160,000 per year.

View full job page →

Get Scap & Stig Engineer Jobs alerts

New Scap & Stig Engineer Jobs, daily.