Information Assurance Specialist IV

We are an employee-centric company that truly values our team members and the contributions they make to our customers and the missions they support. We pride ourselves on being forward-leaning thinkers and on building teams that are, and continue to be, technically proficient across a broad range of cyber mission areas. OneZero full-time employees receive a highly competitive benefits package, including health, dental, vision, and life insurance, a 401(k) with company matching, paid time off and holidays, an employee referral program, and educational assistance. Additional details are available on our website: https://www.onezerollc.com/careers/

Position Title: Information Assurance Specialist IV

Location: Arlington, VA or Mechanicsburg, PA

Clearance: Secret

Job Summary:

The Information Assurance Specialist IV is key personnel providing senior Information System Security Officer (ISSO), Security Control Assessor (SCA), and Security Controls Validator (SCA-V) support across DSCA's five IM&T. The role ensures the confidentiality, integrity, and availability of data on assigned systems, leads operationalization of RMF/CSRMC in a cloud-native DevSecOps environment, and drives automation of control implementation, evidence collection, and authorization artifacts in support of A&A, Assess Only, and continuous ATO (cATO) outcomes.

Education and Experience:

• Bachelor's degree from an accredited institution in Information Technology, Computer Science, Engineering, or a related technical discipline.
• Current DoW 8570/8140 certification meeting the IAM Level II or IAT Level II baseline requirement (e.g., CISSP, Security+ CE, CISM, CASP+ CE).
• Five (5) years of dedicated Information Assurance experience, with at least three (3) of those years being consecutive.
• Three (3) consecutive years directly relevant to the tasks above, demonstrating a hands-on understanding of the DoW cybersecurity environment.
• Active Secret clearance; U.S. citizenship required.

Essential Duties:

• Serving as ISSO for assigned DSCA IM&T portfolio systems, ensuring confidentiality, integrity, and availability of data residing on or transiting those systems.
• Leading operationalization of the RMF/Cybersecurity Risk Management Construct (CSRMC) within a cloud-native, DevSecOps framework, and automating security control implementation and evidence collection to achieve and maintain A&A, Assess Only, and cATO accreditations.
• Proactively identifying and mitigating security weaknesses and maintaining accurate, current security documentation.
• Developing the Security Assessment Plan (SAP) and conducting ongoing assessments of security controls beyond periodic compliance checks.
• Providing actionable risk analysis that prioritizes vulnerabilities and control deficiencies, and interpreting and validating outputs of automated validation tools and Policy-as-Code scripts.
• Developing and maintaining key authorization artifacts, including the Security Assessment Report (SAR), the Authorization Recommendation Memo, and the program's overarching ATO documentation.
• Performing SCA-V duties: validating security and compliance content, assessing CaC profiles and scripts, and verifying that automated compliance evidence is correctly ingested and reflected.
• Maintaining the eMASS record as the system of record, documenting all assessment activities, findings, and evidence in a timely and accurate manner.
• Performing in-depth risk analysis and POA&M support and providing written recommendations for mitigation and validation of proposed corrective actions.
• Preparing and assembling the Security Authorization Package and briefing the SCA, ISSM, and other stakeholders on assessment results and residual risk.

Knowledge, Skill and Abilities:

• Expert knowledge of RMF, NIST SP 800-53, DISA STIGs, and the Cybersecurity Risk Management Construct (CSRMC).
• Master-level proficiency in eMASS as the authoritative system of record for assessment and authorization data.
• Familiarity with FedRAMP, DoW Impact Levels, and the DoW Cloud Computing Security Requirements Guide (CCSRG).
• Hands-on experience securing AWS cloud-native architectures and authorized SaaS solutions.
• Ability to review and validate Compliance-as-Code (CaC) and Policy-as-Code (PaC) profiles, scripts, and automated compliance evidence.
• Skill in risk analysis, POA&M development, and drafting decision-quality authorization documentation (SAP, SAR, Authorization Recommendation Memo).

Clear, no-surprises reporting and effective collaboration with system owners, ISSMs,

OneZero Solutions, LLC is an Equal Opportunity employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, age, pregnancy, genetic information, disability, status as a protected veteran, or any other protected category under applicable federal, state, and local laws.

To request an accommodation, please contact us at [email protected] or call (202) 987-2580.