Cybersecurity Engineer

Quantum Sky supports a government program in Virginia Beach with on-site cybersecurity engineering. If you want work that connects day-to-day engineering to authorization outcomes, this role focuses on RMF execution across the SDLC, vulnerability/STIG assessment, and building authorization documentation that moves systems toward ATO.

Compensation: USD 100,000 - 112,000 per year. Location: Virginia Beach, VA (onsite) at Dam Neck Activity (DNA). Security: Current active Secret clearance as reported in DISS.

Responsibilities

• Provide cybersecurity engineering support as part of the system development life cycle (SDLC) by integrating security requirements into architecture, design, development, testing, assessment, authorization, delivery, and sustainment.
• Apply the cybersecurity risk management framework (RMF) in accordance with NIST SP 800-37 and DoDI 8510.01.
• Implement RMF life cycle steps to achieve system authorization and operation, including building, maintaining, and tracking cybersecurity baselines and authorization documentation in eMASS (Enterprise Mission Assurance Support Service).
• Support cybersecurity architecture and assessment & authorization (A&A) efforts that lead to an Authority to Operate (ATO) decision.
• Identify and apply cybersecurity best practices using a plan aligned to DoD and Navy cybersecurity strategy, managing adaptation and incorporating security management into hardware, software, and applications.
• Assist government managers with information security oversight, policy analysis, IT product acquisition, and program execution aligned to NIST SP 800-39 and DoDI 8500.01.
• Collaborate with Program Office managers and technical stakeholders to interpret technical requirements, standards and policies, architectural artifacts, budget development, implementation, auditing, program briefs, and continuous monitoring.
• Review ACAS vulnerability scans and evaluate STIGs and SCAP content for applicable system components.
• Prepare and review authorization-related documentation, including Systems Security Plans (SSP), Security Assessment Plans (SAP), Risk Assessment Reports (RAR), A&A packages, and System Requirements Traceability Matrices (SRTMs).

Requirements

• Four (4) or more years of experience in IT security, including RMF methodology and A&A.
• Bachelor’s Degree in computer science, cybersecurity, information systems, or other related technical discipline (or Associate’s Degree and six (6) or more years of cybersecurity experience).
• CSWF Intermediate Level knowledge/skills (IAT Level II), with specific course completion or renewal certificate.
• Exceptional understanding of DoD cybersecurity policies, RMF steps and structure, A&A process, and gaining ATO.
• Ability to operate DISA tools including STIG Viewer and eMASSter, with strong familiarity with eMASS functionality.
• Strong communication skills across the IT workforce, including translating complex technical topics for senior decision-makers and preparing/delivering presentations to leadership.

Preferred

• Familiarity with Department of the Navy cybersecurity policies, organizations, and missions.
• CSWF Advanced Level knowledge/skills (IAT Level III).

Benefits

• Health/Dental/Vision
• 401(k) match
• Paid Time Off
• STD/LTD/Life Insurance
• Referral Bonuses
• Professional development reimbursement
• Parental leave

Tools and Frameworks

Work involves NIST SP 800-37, DoDI 8510.01, eMASS, NIST SP 800-39, DoDI 8500.01, ACAS, STIGs, SCAP, and DISA tools including STIG Viewer and eMASSter.