IT Security Specialist II
Remote IT Security Specialist II conducting RMF security assessments for federal High/Moderate systems: running security scanning and monitoring tools, validating AWS security controls, maintaining CSAM records and compliance documentation (NIST, FISMA, STIG), and supporting POA&M remediation and retesting.
- Compensation
- Not disclosed
- Location
- Silver Spring, MD, USA
- Work setup
- Remote
- Seniority
- Not specified
- Employment
- Not specified
- Experience
- 2+ years
- Category
- Security
- Posted
Skills
Must have
- Bachelor's degree in Engineering, IT, Business, or related field (or equivalent experience)
- 2-4 years of IT security experience, including at least 3 years supporting federal government systems
- Senior hands-on AWS security expertise in complex cloud environments
- Experience with security repository tools such as CSAM
- Experience with NIST SP 800-37, NIST 800-53, FISMA A&A, and federal IT security policies
- Strong threat mindset and ability to perform comprehensive QA on security findings and reports
- Proven experience implementing, validating, and monitoring AWS security controls and metrics
- Skilled in cloud vulnerability management (identification, prioritization, remediation coordination)
- Understanding of security controls and enclave requirements for FISMA High/Moderate
- Able to learn and support POA&M processes
- Outstanding communication skills; calm, professional, and diplomatic temperament supporting a challenging ISSO
- Proficiency in IT security concepts, methodologies, and industry-standard security tools
- Proficiency with enterprise architecture methodologies, concepts, procedures, and tools
- Familiarity with scanning and monitoring tools and cloud security assessments
- Proficiency in Microsoft Office suite (Word, Excel, PowerPoint, Visio, Project)
- Strong verbal and written communication skills; adaptable in federal client environments
- Ability to obtain security clearance
Nice to have
- Certifications: CISSP, CEH, CISM, CCSP, CISA, CompTIA Security+
- Additional certifications such as AWS Certified Security – Specialty or Azure Security Engineer Associate
- Experience with network, endpoint, cloud, and identity/access security, including penetration testing
- Experience developing and maintaining IT security documentation (authorization packages, policies, SOPs, templates)
- Awareness of evolving cybersecurity threats, standards, and best practices
Full description
About the Opportunity
The IT Security Specialist II supports timely, high-quality security assessments for High and Moderate systems under the Risk Management Framework (RMF) in a remote environment. This role assesses vulnerabilities, evaluates security controls, operates security scanning and monitoring tools, maintains security artifacts and CSAM records, and supports POA&M remediation and evidence retesting.
Success in this role means maintaining a secure, compliant, and well-documented environment by applying NIST, FISMA, STIG, and agency-specific requirements, collaborating effectively with system teams and federal stakeholders, and consistently delivering accurate work within established timelines.
What You'll Do
The IT Security Specialist II conducts security assessments, monitors and remediates vulnerabilities, maintains compliance documentation and CSAM records, supports POA&M activities, and collaborates with system teams to ensure federal security requirements are met
Responsibilities include:
- Operate and maintain security scanning and monitoring tools to identify vulnerabilities and monitor system security.
- Collect, organize, and maintain security artifacts for compliance and audit purposes.
- Update and maintain IT security policies, procedures, SOPs, templates, and checklists for security operations and assessments.
- Document and maintain CSAM entries to reflect current system compliance status.
- Assist with POA&M updates, including tracking remediation progress and retesting evidence to verify resolution of findings.
- Support vulnerability management and remediation activities, ensuring compliance with STIGs, NIST standards, and federal cybersecurity policies.
- Review all relevant system and core security documentation for assessments.
- Document computer security and emergency measures policies, procedures, and tests.
- Perform security risk assessments and evaluate system security controls to ensure effective security measures and compliance.
- Collaborate with program managers, developers, and infrastructure teams to embed security throughout the system lifecycle.
- Train and mentor junior staff in cybersecurity best practices and federal compliance requirements.
- Perform other duties and responsibilities as assigned
What You'll BringRequired Qualifications
- Bachelor’s degree in Engineering, Information Technology, Business, or a related field (or equivalent work experience).
- 2-4 years of experience in IT security, with at least 3 years supporting federal government systems.
- Senior, hands on AWS security expert with deep experience in complex cloud environments.
- Experience with Security Repository Tools, such as Cyber Security Assessment and Management (CSAM)