Information Assurance Specialist III

Job Description

Job Description

We are an employee-centric company that truly values our team members and the contributions they make to our customers and the missions they support. We pride ourselves on being forward-leaning thinkers and on building teams that are, and continue to be, technically proficient across a broad range of cyber mission areas. OneZero full-time employees receive a highly competitive benefits package, including health, dental, vision, and life insurance, a 401(k) with company matching, paid time off and holidays, an employee referral program, and educational assistance. Additional details are available on our website: Information Assurance Specialist IIILocation: Mechanicsburg, PA (preferred) or Arlington, VA (DSCA HQ)Clearance: Secret Position SummaryOneZero Solutions is seeking Information Assurance Specialists to support the Defense Security Cooperation Agency (DSCA), the DoD agency responsible for the transfer, sale, and lease of U.S. defense articles and services to international partners. As part of the DSCA Cybersecurity Support Services program, you will deliver hands-on Risk Management Framework (RMF) and Cybersecurity Risk Management Construct (CSRMC) support across approximately 25 systems - serving in ISSO, Security Control Assessor, and SCA-Validator capacities within a cloud-native, DevSecOps-oriented AWS environment. This is an execution role at the heart of DSCA's security posture: you will own authorization packages in eMASS, drive controls to compliance, and help move the program from manual assessment toward automated, Compliance-as-Code continuous monitoring.Key ResponsibilitiesManage Assessment & Authorization (A&A) packages through the RMF/CSRMC lifecycle in eMASS, maintaining the authorization package as the authoritative GRC record - control implementation details, assessment evidence, and full POA&M lifecycle from creation to closure.Support achievement and maintenance of Assess and Authorize (A&A), Assess Only, and Continuous ATO (cATO) accreditations, including system categorization and control selection, tailoring, and implementation.Assess security control implementation across traditional and cloud-native services (containers, serverless, service meshes, Infrastructure-as-Code) and evaluate SaaS offerings against FedRAMP and DoD Cloud Computing SRG requirements, documenting shared-responsibility and control inheritance.Conduct security control assessments as SCA/SCA-V: execute Security Assessment Plans through interviews, documentation review, configuration inspection, and technical testing; independently validate automated and manual test results before findings are formalized.Develop and maintain RMF documentation - SSPs, control family plans, SAPs, SARs, risk assessments, and POA&Ms - automating documentation and evidence collection wherever possible.Leverage and interpret Compliance-as-Code (CaC) output (e.g., AWS Inspector, Security Hub, AWS Config) to validate compliance against NIST SP 800-53 controls and DISA STIGs, and verify automated evidence is accurate and audit-ready in eMASS.Monitor security posture within CI/CD pipelines (SAST/DAST, software composition analysis, container image scanning) and coordinate remediation with development teams before deployment.Perform risk analysis prioritizing vulnerabilities by mission impact; brief ISSMs, system owners, and Government stakeholders on findings, risk posture, and remediation strategy.Support incident response for cloud-native systems and coordinate with the CSSP and mission partners as required.Required QualificationsThree (3) years of dedicated Information Assurance experience, with at least two (2) years consecutive, including hands-on RMF execution, security control assessment, POA&M management, and continuous monitoring.Current DoD 8570/8140-qualifying certification appropriate to the assigned DCWF work role (612/722) - CompTIA Security+ CE minimum.Active SECRET security clearance (favorably adjudicated T3 investigation) and U.S. citizenship - required at start of performance.Working knowledge of NIST SP 800-53 (Rev 5), NIST SP 800-37/RMF, FISMA, and DoD cybersecurity policy (DoDI 8510.01).Ability to work on site at DSCA Mechanicsburg, PA or Arlington, VA as required, including for SIPR-designated work.Preferred QualificationseMASS experience (package management, control records, POA&M administration).Experience securing or assessing AWS environments (GovCloud, AWS-native security tooling: Security Hub, Inspector, GuardDuty, Config) and familiarity with FedRAMP and the DoD Cloud Computing SRG.Exposure to DevSecOps pipelines, Infrastructure-as-Code, or Policy/Compliance-as-Code approaches to control validation.Vulnerability management experience with ACAS/Tenable Nessus and DISA STIG/SCAP compliance scanning.CISSP, CISM, CGRC/CAP, CySA+, or CASP+/SecurityX certification.Technical SkillseMASS · NIST SP View phone number on ziprecruiter.com · DISA STIGs & SCAP · ACAS/Tenable Nessus · AWS security services (Security Hub, Inspector, GuardDuty, Config, CloudTrail) · POA&M management · SSP/SAP/SAR development · continuous monitoring (ISCM) · CI/CD security tooling (SAST/DAST/SCA) · Microsoft Office suiteSecurity ClearanceActive SECRET clearance required (temporary/interim SECRET eligibility adjudicated by DCSA AVS may be accepted). Investigation must be current within 5 years or enrolled in Continuous Evaluation. All personnel must be U.S. citizens.EducationBachelor 's degree in Information Technology, Computer Science, Engineering, Cybersecurity, or a related technical discipline desired. Equivalent additional dedicated IA experience (two additional years) may substitute for the degree.Work EnvironmentHybrid, at Government discretion, anchored to DSCA facilities in Mechanicsburg, PA (preferred duty station - the majority of the DSCA cybersecurity team is located there) or Arlington, VA. OneZero Solutions, LLC is an Equal Opportunity employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, age, pregnancy, genetic information, disability, status as a protected veteran, or any other protected category under applicable federal, state, and local laws.To request an accommodation, please contact us at View email address on ziprecruiter.com or call View phone number on ziprecruiter.com.