Information Assurance and Security Engineer

Responsibilities

Peraton is seeking a Information Assurance and Security Engineer. The position will be responsible for the following but not limited too:

This position is remote

• Provide technical and programmatic information assurance services to internal and external customers in support of network and information security systems across the DEERS application portfolio.
• Design, develop, and implement security requirements within the organization's business processes, including DevSecOps pipelines, cloud migration activities (OCI), and Agile development sprints.
• Prepare and maintain security documentation using accepted DoD and NIST guidelines, including System Security Plans (SSPs), Security Assessment Reports (SARs), Plans of Action and Milestones (POA&Ms), STIG checklists, and implementation plans within eMASS.
• Prepare Security Test and Evaluation (ST&E) plans and support execution of formal security assessments in coordination with the DMDC Cybersecurity Division (CSD) and Enterprise ISSOs.
• Provide Certification and Accreditation (C&A) / Assessment and Authorization (A&A) support, including development of security and contingency plans, in alignment with DoDI 8510.01 and NIST SP 800-37 RMF principles.
• Conduct complex risk and vulnerability assessments; develop and maintain risk mitigation strategies addressing identified weaknesses across the DEERS application environment.
• Analyze organizational policies and procedures against Federal laws and regulations — including FISMA, NIST SP 800-53 Rev 5, DoDI 8500.01, and OMB M-14-03 — and provide recommendations for closing identified compliance gaps.
• Recommend and implement system enhancements to improve security deficiencies; support IAVA (Information Assurance Vulnerability Alert) monitoring and monthly resolution activities.
• Develop, test, and integrate computer and network security tools, including Fortify, Sonatype, and BURP scanning solutions; integrate security scanning into the DevSecOps pipeline for every production release.
• Secure system configurations and install security tools; scan systems to determine compliance against STIG and NIST SP 800-53 Rev 5 baselines; report results and evaluate products and system administration configurations.
• Conduct security program audits and develop solutions to address identified risks; support 1–3 external audits annually (e.g., DHA MERHCF, DoD CIO ICOFR, FIAR).
• Provide IA support for the development and implementation of security architectures to meet new and evolving security requirements, including support for OCI cloud migration at DISA IL-4/IL-5 authorization levels.
• Provide assistance in computer incident investigations; report cyber incidents within 1 hour of discovery per DFARS 252.204-7012 and DMDC IR Team protocols, with follow-up reporting every 24 hours until closure.
• Perform vulnerability assessments including development of risk mitigation strategies; submit POA&Ms within 3 business days of Category 1 or 2 vulnerability identification and update within 10 business days of vulnerability events.
• Support Information Security Continuous Monitoring (ISCM) activities per NIST SP 800-137/137A, DoDI 8530.01, and DoDI 8531.01, and report weekly vulnerability scan status during Integrated Progress Reviews (IPRs).
• Maintain and support the program's ATOs and A&I packages through the full RMF lifecycle — Prepare, Categorize, Select, Implement, Assess, Authorize, and Monitor.
• Implement JFHQ-DODIN and USCYBERCOM Cyberspace Tasking Orders (CTOs) as directed.
• Ensure all cybersecurity workforce personnel are identified, screened, trained, and certified in accordance with DoD 8140.03 and CMMC (DFARS 252.204-7021) requirements.
• Conduct and support mandatory security training including OPSEC, CUI Handling, Insider Threat, Privacy Act/PII, IT Security Awareness, Counterintelligence, Antiterrorism Level I, and Records Management.

Qualifications

• Minimum of 8 years with BS/BA; Minimum of 6 years with MS/MA; Minimum of 3 years with PhD, 12 years with HS diploma
• Ability to obtain and maintain DOD Public Trust
• Hands-on experience with the DoD Risk Management Framework (RMF) and associated tooling, specifically eMASS (Enterprise Mission Assurance Support Service).
• In-depth knowledge of NIST SP 800-53 Rev 5, NIST SP 800-37, NIST SP 800-171 Rev 2, NIST SP 800-137, FISMA, DoDI 8510.01, and DoDI 8500.01.
• Experience conducting vulnerability assessments, developing POA&Ms, and managing the full A&A lifecycle including ATO package development.
• Experience with application security scanning tools including Fortify, Sonatype, and BURP; familiarity with OWASP secure coding practices.
• Working knowledge of STIG compliance verification, checklist preparation, and remediation.
• Demonstrated experience supporting DevSecOps security practices within Agile development environments.
• DoD 8140.03 / DoD 8570.01-M compliant certification IAT/IAM Level II (e.g., CISSP, CASP+, CEH, Security+, or equivalent certification).

Preferred Qualifications

• Active Public Trust clearance.
• CISSP (Certified Information Systems Security Professional) or equivalent advanced certification.
• Experience with cloud security at FedRAMP Moderate, DISA IL-4, or DISA IL-5 authorization levels; familiarity with Oracle Cloud Infrastructure (OCI) security configuration.
• Familiarity with CMMC (Cybersecurity Maturity Model Certification) framework and compliance.
• Experience supporting external DoD financial/operational audits (FIAR, ICOFR, FISCAM).
• Working knowledge of ServiceNow, JIRA, and SharePoint in an ITSM/project context.
• Knowledge of DFARS 252.204-7012 cyber incident reporting requirements.
• Experience implementing cyberspace tasking orders (CTOs) from JFHQ-DODIN or USCYBERCOM.
• Prior experience in the S-ISSO role within a large-scale DoD program environment

Peraton Overview

Peraton is a next-generation national security company that drives missions of consequence spanning the globe and extending to the farthest reaches of the galaxy. As the world’s leading mission capability integrator and transformative enterprise IT provider, we deliver trusted, highly differentiated solutions and technologies to protect our nation and allies. Peraton operates at the critical nexus between traditional and nontraditional threats across all domains: land, sea, space, air, and cyberspace. The company serves as a valued partner to essential government agencies and supports every branch of the U.S. armed forces. Each day, our employees do the can’t be done by solving the most daunting challenges facing our customers. Visit peraton.com to learn how we’re keeping people around the world safe and secure.

Target Salary Range$86,000 - $138,000. This represents the typical salary range for this position. Salary is determined by various factors, including but not limited to, the scope and responsibilities of the position, the individual’s experience, education, knowledge, skills, and competencies, as well as geographic location and business and contract considerations. Depending on the position, employees may be eligible for overtime, shift differential, and a discretionary bonus in addition to base pay. EEOEEO: Equal opportunity employer, including disability and protected veterans, or other characteristics protected by law.