Overview
Authorizations and Assessments Manager
Arlington, VA
Are you ready to enhance your skills and build your career in a rapidly evolving business climate? Are you looking for a career where professional development is embedded in your employer’s core culture? If so, Chenega Military, Intelligence & Operations Support (MIOS) could be the place for you! Join our team of professionals who support large-scale government operations by leveraging cutting-edge technology and take your career to the next level!
The Authorizations and Assessments Manager is responsible for the ITD Risk Management Framework and A&A portfolio across information systems, applications, enclaves, cloud environments, and system interconnections. The position leads approximately four Information System Security Managers and their Information System Security Officer teams, totaling more than 20 cybersecurity personnel, and is accountable for A&A quality, timeliness, authorization readiness, continuous monitoring, vulnerability remediation, and cybersecurity risk reporting.
The position also provides administrative and operational oversight of the Security Control Assessor Lead and SCA team. The SCA Lead retains independent responsibility for assessment planning, methodology, technical findings, risk determinations, and assessment reporting. The Authorizations and Assessments Manager supports government authorization decisions but does not independently grant authorizations, approve connections, accept risk, or direct assessment conclusions.
Responsibilities
- Lead and manage the directorate wide RMF and A&A portfolio for systems, applications, cloud environments, enclaves, and interconnections.
- Direct and mentor ISSMs and ISSO teams. Establish workforce priorities, roles, performance expectations, workload assignments, cross training, quality standards, and escalation procedures.
- Ensure timely, accurate, and complete A&A packages and supporting security documentation, including System Security Plans, security assessment artifacts, POA&Ms, contingency plans, incident response documentation, control implementation statements, and continuous monitoring evidence.
- Maintain portfolio visibility for authorization status, assessment schedules, authorization expiration dates, significant changes, POA&M aging, vulnerability remediation, continuous monitoring completion, and resource risks.
- Establish and enforce directorate procedures, templates, quality assurance reviews, metrics, dashboards, and governance processes for RMF, A&A, continuous monitoring, and risk reporting.
- Direct the identification, tracking, prioritization, and remediation of vulnerabilities, STIG findings, IAVM requirements, configuration weaknesses, and other cybersecurity deficiencies.
- Coordinate with system owners, engineering, operations, system administrators, security tools teams, government cybersecurity leadership, and Authorizing Official representatives to resolve A&A requirements and cybersecurity risks.
- Provide executive ready status reports, risk dashboards, decision support materials, and briefings to program and government leadership.
- Provide administrative, operational, and programmatic oversight of the SCA Lead and SCA team, including staffing, resourcing, training, delivery schedules, performance management, and assessment readiness.
- Preserve SCA independence by ensuring the SCA Lead retains authority over assessment planning, assessor assignments, methodology, evidence evaluation, findings, risk determinations, and assessment reports.
- Maintain separation between ISSM and ISSO operational security duties and SCA assessment activities. Ensure SCA personnel are not assigned to assess systems for which they performed implementation, administration, ISSM, ISSO, or other potentially conflicting duties.
- Ensure SCA findings are not altered, suppressed, deferred, or downgraded because of operational, staffing, schedule, or programmatic considerations. Elevate unresolved assessment independence concerns or material disagreements to the Deputy Program Manager and appropriate government leadership.
- Oversee A&A support for system interconnections, connection approval packages, data flows, System Interconnection Agreements, and authorized file transfer processes. Provide technical risk analysis and recommendations to government decision authorities.
- Support recruiting, onboarding, professional development, performance management, staffing forecasts, contract deliverables, and process improvement activities for the A&A workforce.
- Perform other duties as assigned.
Qualifications
- Bachelor’s degree or higher. Can be substituted for associate’s degree with 2+ years of relevant experience or High school diploma/GED equivalent with 4+ years relevant experience.
- 12+ years relevant cybersecurity, RMF, A&A, information assurance, or information systems security experience.
- 5+ years leading cybersecurity, ISSM, ISSO, RMF, A&A, or security operations teams.
- 3+ years managing or leading a multi system A&A portfolio.
- Experience managing or providing technical direction to ISSMs, ISSOs, or equivalent cybersecurity personnel.
- Experience with eMASS, Xacta, or equivalent RMF and authorization workflow tools.
- DOD 8140 IAM Level II (CAP, CASP, CISM, CISSP, GSLC, CCISO).
- Top Secret Clearance with SCI eligibility is required.
Knowledge, Skills and Abilities:
- Performing work onsite is required.
- Experience supporting DARPA, DoD research environments, or comparable complex DoD enterprise environments.
- Experience leading A&A activities across multiple information systems, enclaves, applications, cloud environments, and system interconnections.
- Experience developing, reviewing, and maintaining A&A packages, including SSPs, assessment artifacts, POA&Ms, contingency plans, incident response documentation, and continuous monitoring evidence.
- Experience managing authorization schedules, assessment readiness, POA&M aging, vulnerability remediation, continuous monitoring, and cybersecurity risk reporting.
- Experience leading and mentoring ISSM and ISSO teams and establishing workforce priorities, quality standards, workload assignments, and escalation procedures.
- Experience coordinating with system owners, system administrators, engineers, government cybersecurity leadership, Security Control Assessors, and Authorizing Official representatives.
- Knowledge of specialized government network architectures, including SIPR, NIPR, and other classified and unclassified environments.
- Background in system engineering, network architecture, vulnerability management, or security control assessment.
- Familiarity with ACAS, Tenable, Splunk, SIEM platforms, vulnerability tracking tools, and automated risk assessment methodologies.
- Ability to develop executive ready status reports, risk dashboards, decision support materials, and cybersecurity briefings.
- Ability to manage SCA staffing, resources, schedules, and assessment readiness while preserving independent assessment planning, technical findings, risk determinations, and assessment reporting.
- Ability to identify, document, and elevate actual, potential, or perceived conflicts of interest affecting independent security assessments.
- Working knowledge of DOD Cybersecurity Regulations to include:
- (U) NIST Federal Information Processing Standard Publication (FIPS) No. 199, “Standards for Security Categorization of Federal Information and Information Systems,” February 2004
- (U) NIST Federal Information Processing Standard Publication (FIPS) No. 200, “Minimum Security Requirements for Federal Information and Information Systems,” March 2006
- (U) NIST Special Publication 800 37, “Risk Management Framework for Information Systems and Organizations,” current edition
- (U) NIST Special Publication 800 53, “Security and Privacy Controls for Information Systems and Organizations,” current edition
- (U) NIST Special Publication 800 53A, “Assessing Security and Privacy Controls in Information Systems and Organizations,” current edition
- (U) NIST Special Publication 800 137, “Information Security Continuous Monitoring for Federal Information Systems and Organizations,” current edition
- (U) NIST Special Publication 800 59, “Guideline for Identifying an Information System as a National Security System,” August 2003
- (U) NIST Special Publication 800 60, Volumes I and II, Revision 1, “Guide for Mapping Types of Information and Information Systems to Security Categories,” August 2008
- (U) Committee on National Security Systems Instruction (CNSSI) No. 1253, “Security Categorization and Control Selections for National Security Systems,” current edition
- (U) DoD Instruction 8510.01, “Risk Management Framework for DoD Information Technology,” current edition
- (U) DoD Instruction 8500.01, “Cybersecurity,” current edition
- Joint Special Access Program Implementation Guide (JSIG)
How you’ll grow
At Chenega MIOS, our professional development plan focuses on helping our team members at every level of their careers to identify and use their strengths to do their best work every day. From entry-level employees to senior leaders, we believe there’s always room to learn.
We offer opportunities to help sharpen skills in addition to hands-on experience in the global, fast-changing business world. From on-the-job learning experiences to formal development programs, our professionals have a variety of opportunities to continue to grow throughout their careers.
Benefits
At Chenega MIOS, we know that great people make a great organization. We value our team members and offer them a broad range of benefits.
Learn more about what working at Chenega MIOS can mean for you.
Chenega MIOS’s culture
Our positive and supportive culture encourages our team members to do their best work every day. We celebrate individuals by recognizing their uniqueness and offering them the flexibility to make daily choices that can help them be healthy, centered, confident, and aware. We offer well-being programs and continuously look for new ways to maintain a culture where we excel and lead healthy, happy lives.
Corporate citizenship
Chenega MIOS is led by a purpose to make an impact that matters. This purpose defines who we are and extends to relationships with our clients, our team members, and our communities. We believe that business has the power to inspire and transform. We focus on education, giving, skill-based volunteerism, and leadership to help drive positive social impact in our communities.
Learn more about Chenega’s impact on the world.
Chenega MIOS News- https://chenegamios.com/news/
Tips from your Talent Acquisition Team
We want job seekers exploring opportunities at Chenega MIOS to feel prepared and confident. To help you with your research, we suggest you review the following links:
Chenega MIOS web site - www.chenegamios.com
Glassdoor - https://www.glassdoor.com/Overview/Working-at-Chenega-MIOS-EI_IE369514.11,23.htm
LinkedIn - https://www.linkedin.com/company/1472684/
Facebook - https://www.facebook.com/chenegamios/
Estimated Salary/Wage USD $175,200.00/Yr. Up to USD $200,000.00/Yr.
