(781) Cybersecurity Technical Specialist Level III / ISSO

Company Summary Arlo Solutions (Arlo) is an information technology consulting services company that specializes in delivering technology solutions. Our reputation reflects the high quality of the talented Arlo Solutions team and the consultants working in partnership with our customers. Our mission is to understand and meet the needs of both our customers and consultants by delivering quality, value-added solutions. Our solutions are designed and managed to not only reduce costs, but to improve business processes, accelerate response time, improve services to end-users, and give our customers a competitive edge, now and into the future. Position Overview Arlo Solutions seeks an experienced Cybersecurity Technical Specialist III / ISSO to support U.S. Army ATEC cybersecurity operations. The position provides technical expertise in DoD Risk Management Framework (RMF), security-control analysis, vulnerability management, eMASS, POA&M management, and Continuous Monitoring. Candidates must reside near APG or independently relocate before employment. Full-time, on-site attendance at the Government installation is mandatory. RMF Execution: - Perform assigned RMF activities under DoDI 8510.01, NIST SP 800-37, NIST SP 800-53/53A, CNSSI No. 1253, and applicable Army requirements. Security Controls: - Analyze control implementations, technical configurations, compliance evidence, and deficiencies - develop accurate implementation statements and corrective recommendations. eMASS Management: - Maintain assigned authorization packages, security controls, artifacts, findings, and supporting documentation for ATO/IATT and Continuous Monitoring activities. Vulnerability Management: - Review ACAS, SCAP, STIG, and other assessment results; - validate findings, coordinate remediation, and maintain accurate tracking records. POA&M Management: - Document weaknesses, track remediation milestones, validate corrective actions, and maintain supporting evidence and traceability. Continuous Monitoring: - Conduct recurring security reviews, identify emerging risks, monitor compliance, and report material cybersecurity changes. Technical Quality Assurance: - Independently verify technical accuracy, completeness, evidence, and compliance before submitting deliverables. Incident Coordination: - Report significant vulnerabilities, suspected incidents, and security deficiencies through authorized channels. - Collaborate with Team Leads, ISSMs, System Administrators, security assessors, and Government stakeholders to obtain evidence, validate configurations, resolve findings, and accomplish assigned RMF responsibilities. - Maintain operational leadership visibility and communicate progress, obstacles, and cybersecurity risks professionally. - Prepare and present accurate technical briefings covering RMF activities, vulnerabilities, security controls, POA&Ms, and Continuous Monitoring. - Explain findings, supporting evidence, risks, remediation recommendations, and outstanding actions. - Provide timely status updates and identify issues requiring leadership attention. - The assigned Team Lead/O-ISSM serves as the primary operational tasking lead, operating under the oversight of the Project Lead, Program Manager, and authorized Government TPOC. - Employees must follow reasonable, authorized direction from designated leadership, meet established deadlines, and promptly communicate conflicting instructions, technical concerns, or delays. - System assignments do not confer exclusive ownership or independent managerial, ISSM, SCA, or Authorizing Official authority. Professional Attire: - Maintain APG/ATEC-required professional business attire throughout on-site duty hours, subject to approved exceptions. Professionalism: - Demonstrate respect, integrity, accountability, courtesy, and constructive workplace communication. Customer Relations: - Maintain professional Government relationships and follow established communication and escalation procedures. Teamwork: - Collaborate effectively, respect leadership responsibilities, accept constructive feedback, and support mission priorities. Technical Accuracy: - Validate all assigned technical work before submission; promptly correct identified deficiencies. Policy Compliance: - Follow Arlo Solutions Employee Handbook requirements, Government workplace policies, security procedures, and authorized operational direction. Performance Standard: - Deliver accurate, timely, technically defensible cybersecurity work while maintaining professionalism, accountability, effective communication, and continuous support of the U.S. Army ATEC mission. Work Location: (On-site Requirements) Aberdeen Proving Ground, MD Clearance: Active Secret clearance. Responsibilities and/or Success Factors: - Execute assigned RMF responsibilities under DoDI 8510.01, NIST SP 800-37, NIST SP 800-53/53A, CNSSI No. 1253, and applicable Army cybersecurity requirements. - Support system categorization, security-control implementation, assessments, authorization, and Continuous Monitoring. - Analyze technical configurations, control implementations, compliance evidence, and cybersecurity documentation. Identify deficiencies, unsupported compliance assertions, and documentation inconsistencies; recommend corrective actions. - Support ATO, IATT, reauthorization, and ongoing authorization requirements. - Develop, review, maintain, and validate assigned eMASS authorization packages, security controls, implementation statements, assessment evidence, and findings. - Ensure documentation accurately reflects system configurations, security posture, and compliance status. - Maintain traceability between security controls, supporting evidence, assessment findings, and POA&Ms. - Coordinate authorization-package updates, quality reviews, and submissions through established RMF leadership. - Evaluate NIST SP 800-53 security controls against documented implementations and technical evidence. - Validate findings, identify compliance gaps, distinguish false positives, and assess inherited controls. - Develop defensible recommendations for remediation, mitigation, additional assessment, or risk acceptance. - Coordinate technical validation with authorized System Administrators and cybersecurity stakeholders. - Review ACAS, SCAP, DISA STIG, and other approved vulnerability assessment results. - Identify vulnerabilities, configuration weaknesses, affected assets, and compliance deficiencies. - Conduct recurring vulnerability reviews and maintain accurate Government-approved tracking records. - Develop and maintain POA&Ms documenting findings, risks, remediation milestones, and supporting evidence. - Validate remediation before recommending closure; escalate significant unresolved risks. - Perform recurring security-control reviews, vulnerability assessments, compliance checks, and cybersecurity reporting. - Identify system changes, emerging threats, and conditions affecting authorization or cybersecurity posture. - Support Continuous Monitoring documentation, corrective actions, and risk tracking. - Promptly report suspected incidents, significant vulnerabilities, and security-control failures through authorized channels. - Support incident-response coordination without independently accepting risk or approving exceptions. - Prepare accurate, complete, traceable, and technically defensible cybersecurity deliverables. - Independently verify technical findings, asset identifiers, control mappings, vulnerability references, and evidence before submission. - Correct errors, unsupported assertions, and documentation inconsistencies promptly. - Maintain version control, documentation integrity, and compliance with established quality standards. - Collaborate with Team Leads, ISSMs, System Administrators, security assessors, and Government stakeholders. - Coordinate evidence collection, technical investigations, remediation, and RMF activities. - Prepare and present technical briefings addressing vulnerabilities, controls, POA&Ms, risks, and authorization status. - Communicate progress, blockers, outstanding findings, and corrective recommendations professionally. - Maintain leadership visibility and avoid unauthorized commitments. - Minimum Qualifications Including Certificates: Education and Professional Experience: - Bachelor's degree in Cybersecurity, Computer Science, Information Technology, Information Assurance, Engineering, or related field; equivalent experience may qualify when permitted by contract. - Demonstrated experience supporting DoD, U.S. Army, or federal cybersecurity programs. - Hands-on experience performing ISSO, Risk Management Framework (RMF), information assurance, or equivalent cybersecurity responsibilities. - Strong understanding of NIST SP 800-53 security controls, RMF processes, cybersecurity compliance, and authorization requirements. - Experience reviewing security-control implementations, technical evidence, vulnerability findings, and cybersecurity documentation. - Experience supporting authorization packages, Plans of Action and Milestones (POA&Ms), and Continuous Monitoring. - Ability to independently analyze technical cybersecurity issues, validate findings, and produce accurate, defensible deliverables. - Strong analytical, organizational, documentation, communication, and problem-solving skills. Technical Knowledge and Experience - Candidates must demonstrate applicable knowledge and practical experience in: - DoD RMF: DoDI 8510.01, NIST SP 800-37, NIST SP 800-53/53A, CNSSI No. 1253, and applicable DoD/Army cybersecurity requirements. - eMASS: Authorization-package maintenance, security-control documentation, implementation statements, assessment evidence, findings, and workflow support. Vulnerability Management: - ACAS assessments, DISA STIG compliance, SCAP scanning, technical findings analysis, and remediation validation. POA&M Management: - Vulnerability documentation, remediation tracking, milestone management, risk acceptance support, and evidence validation. Continuous Monitoring: - Recurring security reviews, vulnerability tracking, cybersecurity posture assessment, and compliance reporting. Security Control Analysis: - Implementation validation, technical risk assessments, compliance evaluation, and corrective-action recommendations. Enterprise Security: - Windows, Linux, networking, system configurations, and enterprise cybersecurity concepts. Technical Documentation: - Accurate cybersecurity reporting, RMF artifact development, quality assurance, and technical briefings. Certifications and DoD 8140 Compliance - Must satisfy applicable DoD 8140 cybersecurity workforce qualification requirements for the assigned work role, proficiency level, and contract. - Relevant certifications may include CompTIA Security+, CySA+, CASP+/SecurityX, CISSP, or other recognized qualifications. - Additional operating-system, networking, vendor-specific, and cybersecurity certifications are preferred. - Mandatory certifications, education, and experience requirements are determined by the applicable contract, labor category, and designated DoD 8140 work role. Security Clearance and Installation Access - Must meet applicable U.S. citizenship requirements established by the contract. - Must possess or qualify for the required Government security clearance and maintain eligibility throughout employment. - Must satisfy U.S. Army Aberdeen Proving Ground installation access, identity verification, and credentialing requirements. - Must complete required Government cybersecurity awareness, acceptable-use, and security training. - Must comply with applicable DoD, Army, ATEC, and installation security policies. - Must maintain authorized access eligibility for assigned Government facilities, networks, and information systems. Additional Employment Requirements - Must reside within commuting distance of Aberdeen Proving Ground, Maryland, or be willing to self-relocate. - Must work full-time, on-site at the assigned Government installation. - Must demonstrate professional conduct, accountability, effective teamwork, and adherence to established operational direction. - Must independently validate technical work for accuracy, completeness, and compliance before submission. Desired Qualifications: - Previous experience supporting U.S. Army, ATEC, NETCOM, or other DoD cybersecurity programs. - Experience supporting enterprise information systems, network infrastructure, or mission-critical Government environments. - Demonstrated ability to interpret and apply DISA STIG requirements and technical vulnerability assessment results. - Experience supporting cybersecurity authorization or reauthorization efforts. - Experience coordinating technical remediation activities with System Administrators and system engineering teams. - Experience supporting Government inspections, cybersecurity assessments, or technical compliance reviews. - Familiarity with enterprise vulnerability tracking, reporting dashboards, Microsoft Excel, Microsoft Lists, and other approved cybersecurity management tools. - Experience developing technically defensible risk acceptance recommendations and supporting documentation. AAP Statement We are proud to be an Affirmative Action and Equal Opportunity Employer and as such, we evaluate qualified candidates in full consideration without regard to race, color, religion, sex, sexual orientation, gender identity, marital status, national origin, age, disability status, protected veteran status, and any other protected status.