Senior Security Engineer Mid with Security Clearance

Overview Diverse Systems Group, LLC is seeking a Security Engineer to support Walter Reed National Military Medical Center (WRNMMC)'s system security authorization processes in compliance with the Department of Defense (DOD) and Defense Health Agency (DHA)'s NIST RMF related policies and requirements. Responsibilities Lead and perform DHA–specific RMF–related tasks throughout all stages of a system's lifecycle, including stakeholder engagement and development of A&A or Threat Management Team project plans, and preparation and maintenance of FIPS–199 system security categorization. Prepare and maintain FIPS–200 system security controls exceptions; perform risk assessments; analyze risk remediation and mitigation options and strategies; develop, review, and submit A&A system security packages. Select and document applicable NIST 800–53 rev. 4 security controls in SCTMs; collect, develop, and analyze NIST 800–53 rev 4–related security controls artifacts; participate in and oversee IV&V activities; develop and status-track Plans of Action & Milestones (POA&M). Perform Continuous Diagnostics and Monitoring (CDM)–related activities; report status to leadership and stakeholders; maintain security posture to meet DoD RMF requirements. Manage system security packages in eMASS throughout authorization cycles, including system registration, uploading and maintenance of packages, POA&M entry and tracking, and system decommissioning. Conduct technology assessments, reviews, and inspections to identify and mitigate security weaknesses; ensure security features and functionality are implemented and functioning as required. Collaborate with System and Network Administrators to self–assess and harden workstations, servers, network devices, and clinical devices; apply STIGs and run hardening and security artifact collection scripts; perform SCAP and ACAS scans. Develop and maintain cybersecurity training materials and deliver training for users and System Administrators (SA). Maintain comprehensive understanding of federal security regulatory requirements and security frameworks including DoD/DHA IT Security and IA policies, RMF, NIST SP 800–series, FISMA, FIPS, FedRAMP, and related directives. Stay aware of current and emerging threats and vulnerabilities and their potential impact on mission accomplishment, patient safety, and patient data security. Apply security patches, IAVAs, STIGs, and updates for all assigned systems; provide escalation support and communicate status to agency management and internal customers; convey technical information to both technical and non–technical personnel. Implement and manage disaster recovery and COOP plans, systems, and operations. Maintain baseline system security per organizational policies; mitigate cyber threats and vulnerabilities; adhere to IT security principles (firewalls, DMZs, encryption). Provide configuration management and assess the impact of modifications and vulnerabilities for each system; maintain SCTMs with NIST 800–53 controls mapping. Oversee monitoring and resolution of POA&Ms to mitigate system vulnerabilities; ensure documentation for A&A packages supports validation and ATO. Perform comprehensive A&A tasks including package development, controls analysis, risk assessment, contingency planning, security test & evaluation, risk mitigation, and technology assessments; register and complete accreditation packages in DISA eMASS. Lead RMF accreditation lifecycle for assigned systems from cradle to grave, managing stakeholder engagement, lifecycle progression, scheduling, package review, submission, and validation. Maintain and support current A&A packages to ensure uninterrupted delivery of IT systems; create and maintain setup documentation and security policies (SOPs, Policies, Procedures, Plans, guidelines, checklists, presentations, training guides, etc.) in alignment with RMF guidelines. Report on assessment process status; participate in IV&V activities; conduct/oversee IV&V testing as required; assist system certifiers during evaluations. Review regulatory security policies and best practices; develop technical solutions to implement requirements on servers, routers, firewalls and other LAN/WAN equipment. Work with System and Network Administrators to monitor security posture of all networked systems and applications and respond to vulnerabilities. Provide system, network, and security engineering expertise for information assurance to meet DoD regulations and RMF requirements. Manage the cybersecurity program to minimize risk across projects. Oversee a team performing self–assessment and hardening of system servers, applying STIGs, SCAP, ACAS scans, and other scripts. Maintain comprehensive understanding of DoD MHS services and programs, usability standards, and user interface design methodologies. Perform other duties related to the Cybersecurity Division as assigned. Supervisory Responsibility No Requirements / Qualifications Knowledge and experience with DOD RMF A&A artifacts, network architecture, network and security management and monitoring tools, and penetration test tools. Experience with deploying & hardening Windows Server 2012 R2, 2016, 2019. Experience with PowerShell, Tanium, SCAP, NMAP, SQL Developer, Forescout, and/or Splunk. Large Enterprise–level IT experience with maintenance of servers, storage devices and applications. Strong problem solving and critical thinking skills; strong planning & organizational skills; strong verbal and written communication skills for technical and non–technical audiences. Education/Experience: 5+ years of technical experience related to system and/or network administration and/or cybersecurity operations. Certifications: Minimum CompTIA Security+ CE or equivalent (IAM/IAT Level 2) per DoDI 8140 / DoDD 8570; CISSP, CAP, CYSA, CISM, MSCE or equivalent. Clearance: DoD Secret security clearance required. Nice to have: Four-year college degree in Cybersecurity, IT, Computer Information Systems, Computer Science, Computer Engineering, or equivalent (additional experience may substitute for degree). #J-18808-Ljbffr

Created: 2025-09-25