Note: The job is a remote job and is open to candidates in USA. Quivera Enterprises is seeking an experienced Security Engineer – Senior to support the Department of the Interior. This role provides senior-level cybersecurity engineering and Risk Management Framework support for enterprise information systems and involves conducting security assessments, developing security documentation, and ensuring compliance with federal cybersecurity requirements.

Responsibilities

• Conduct security assessments of federal information systems in accordance with NIST SP 800-37 and NIST SP 800-53 guidance
• Develop complete security authorization packages supporting Authority to Operate (ATO) and continuous authorization activities
• Perform system security categorization in accordance with NIST SP 800-60 and FIPS 199 requirements
• Document security control selection and tailoring in accordance with NIST SP 800-53 and NIST SP 800-18
• Develop and maintain System Security Plans (SSPs), Security Assessment Plans (SAPs), Security Assessment Reports (SARs), Risk Assessment Reports (RARs), Plans of Action and Milestones (POA&Ms), Contingency Plans (CPs), and supporting RMF documentation
• Support implementation of RMF activities throughout the System Development Life Cycle (SDLC)
• Conduct technical security assessments of complex information systems, network infrastructures, cloud environments, and industrial control systems with minimal supervision
• Evaluate management, operational, and technical security controls for effectiveness and compliance
• Perform vulnerability analysis and identify security weaknesses affecting federal information systems
• Apply NIST security engineering principles throughout system design, implementation, and operation
• Develop remediation recommendations and mitigation strategies for identified vulnerabilities
• Provide preliminary POA&M recommendations supporting corrective action planning
• Conduct concurrent risk assessments and document findings within Security Assessment Reports
• Support Indian Affairs Risk Management Framework and Continuous Monitoring Programs
• Monitor implementation of security controls to ensure ongoing compliance with federal cybersecurity requirements
• Participate in continuous assessment of technical, operational, and management controls
• Assist with ongoing authorization activities and security documentation updates
• Support compliance with FISMA, Departmental policy, and organizational cybersecurity standards
• Develop initial and updated System Security Plans
• Develop Contingency Plans aligned with NIST SP 800-34 guidance
• Prepare Security Assessment Plans and execute assessment activities
• Develop Security Assessment Reports documenting assessment findings
• Prepare Risk Assessment Reports identifying organizational and system risks
• Develop and maintain POA&M documentation identifying weaknesses, remediation activities, and risk priorities
• Maintain documentation supporting system authorization and continuous monitoring
• Perform enterprise and system-level risk assessments
• Analyze vulnerabilities, threats, likelihood, and impact to determine organizational risk
• Provide risk mitigation recommendations aligned with NIST guidance and industry best practices
• Evaluate configuration management processes supporting secure system operation
• Support contingency planning and disaster recovery planning activities
• Collaborate with Information System Owners, Information System Security Officers, developers, project teams, and IT operations personnel
• Coordinate assessment activities with organizational stakeholders while working independently
• Provide technical guidance regarding security engineering and RMF implementation
• Support implementation of cybersecurity best practices across the enterprise
• Assist organizational stakeholders in understanding security assessment findings and remediation priorities
• Provide multidisciplinary security support across: Physical Security, Computer Security, Personnel Security, Information Security, Administrative Security, Operational Security, Communications Security
• Support strategic implementation of security controls across enterprise information systems
• Participate in process improvement initiatives supporting cybersecurity maturity
• Maintain awareness of emerging cybersecurity threats, technologies, and federal regulatory changes

Skills

• Bachelor's degree and four (4) years of relevant professional experience; or
• Master's degree and three (3) years of relevant professional experience; or
• Six (6) years of directly related professional experience in lieu of a degree
• Experience supporting Risk Management Framework (RMF) activities
• Experience conducting technical security assessments
• Experience developing complete security authorization packages
• Experience with information assurance or cybersecurity engineering
• Experience implementing NIST RMF guidance
• Experience conducting security assessments of complex information systems with minimal supervision
• Experience performing vulnerability assessments and risk analysis
• Experience developing POA&Ms and remediation recommendations
• Experience supporting continuous monitoring activities
• Experience evaluating management, operational, and technical security controls
• NIST SP 800-37 Risk Management Framework
• NIST SP 800-53 Security Controls
• NIST SP 800-18 System Security Plans
• NIST SP 800-34 Contingency Planning
• NIST SP 800-27 Security Engineering
• NIST SP 800-60 Information Categorization
• FIPS 199
• Risk Assessment & Management
• Vulnerability Analysis
• Configuration Management
• Disaster Recovery
• Contingency Planning
• Security Engineering
• Authorization & Assessment (A&A)
• Security Authorization Packages
• Continuous Monitoring
• Federal Information Security Modernization Act (FISMA)
• CISSP
• CAP (Certified Authorization Professional)
• Security+
• CASP+
• CISM
• CEH
• GSEC
• Experience supporting Department of the Interior or Bureau of Indian Affairs
• Experience with eMASS, CSAM, Xacta, Archer, or similar GRC platforms
• Experience supporting cloud security and FedRAMP initiatives
• Experience with industrial control systems (ICS) or operational technology (OT) environments

Company Overview