Responsibilities
- Conduct in-depth technical, operational, and programmatic inspections, assessments, and audits of agency systems, applications, and enterprise services.
- Provide task leadership, work allocation, and mentorship to team members across assigned assessments; perform quality assurance reviews of deliverables; and ensure the timely, accurate completion of assessment activities and associated reporting milestones.
- Collect, analyze, and present accurate, risk-informed IT and cybersecurity technical and programmatic information.
- Support the maturation and continuous improvement of the cybersecurity assessment program, partnering closely with federal leadership and staff to strengthen methodologies, governance processes, reporting standards, and enterprise assessment capabilities.
- Develop, document, and maintain program processes, procedures, standards, and assessment methodologies.
- Support enterprise strategic planning and program oversight initiatives, including cybersecurity capability roadmaps, governance enhancements, performance measures, and long-range modernization objective to strengthen cybersecurity posture, operational maturity, and implementation effectiveness.
- Provide executive-level input on program status, risk posture, performance metrics, and trend analysis, including the identification of recurring findings, systemic gaps, and strategic improvement opportunities.
- Obtain and maintain DOE Derivative Classifier certification(s) as required to support mission and program responsibilities.
- Maintain required professional certifications through continuous professional education (CPE) and ongoing professional development, while remaining current on emerging threats, evolving technologies, federal mandates, and cybersecurity best practices.
Requirements
- Bachelor’s degree in Cybersecurity, Information Technology, Computer Science, Engineering, or a related discipline, with 10+ years of relevant professional experience, including 8+ years of dedicated cybersecurity experience. Additional directly related experience may be substituted for the degree requirement.
- At least one DoD 8570 / 8140 compliant certification at the IAT Level III or IAM Level III level, such as CISSP, CISM, CASP+, CISA, GSLC, or GCIH.
- Demonstrated expert-level experience leading and conducting IT and cybersecurity inspections, independent assessments, compliance reviews, and audit activities.
- Deep working knowledge of federal cybersecurity requirements, mandates, and compliance frameworks, including FISMA, NIST SP 800-37, NIST SP 800-53, NIST SP 800-115, CNSSI 1253, and applicable OMB policies and memoranda.
- Exceptional verbal and written communication skills, with the ability to clearly and professionally engage with senior stakeholders, customers, technical teams, and executive leadership.
- Active or current DOE Q Clearance or Top Secret clearance with SCI eligibility, and the ability to successfully obtain and maintain a polygraph, as required.
- U.S. Citizenship required.
Nice to Have
- Demonstrated subject matter expertise in federal cybersecurity baseline requirements, with preferred experience supporting Department of Energy (DOE) environments, directives, and mission systems.
- Strong knowledge of organizational maturity assessment models, particularly those used to evaluate cybersecurity, information technology, and enterprise risk management capabilities.
- Exceptional written communication skills, including proven experience developing cybersecurity policies, standards, procedures, implementation guidance, and process documentation for technical and executive stakeholders.
- Hands-on experience in secure configuration management and system hardening, including application, validation, and tailoring of appropriate DISA STIGs, CIS benchmarks, and other secure baseline standards across enterprise environments.
- Demonstrated experience securing cloud environments, including implementation and assessment of secure configurations across AWS, Azure, or hybrid federal cloud platforms.
- Working knowledge of Zero Trust principles, architectures, and maturity frameworks, with experience evaluating or supporting implementation aligned to federal Zero Trust strategies.
- Experience supporting enterprise vulnerability management programs, including demonstrated proficiency with Tenable Security Center / Tenable.sc, vulnerability analysis, prioritization, and remediation validation workflows.
- Prior experience serving in an Information System Security Manager (ISSM) or equivalent cybersecurity leadership role, with responsibility for governance, risk oversight, and enterprise security program execution.
