Cybersecurity Engineer

Overview

Thank you for considering IT Concepts dba Kentro, where innovation drives opportunity and collaboration leads to success. Our dynamic community of experts is fully committed to advancing our customers' missions, fostering professional growth, and making a positive impact on our communities.

By joining our supportive community, you will find that Kentro is dedicated to your personal and professional development. Together, we can drive meaningful change, spark innovation, and achieve extraordinary milestones.

Kentro is hiring for a Cybersecurity Engineer to support NGA Vertex Information Technology (IT) Services Task Order

Location: Onsite NGA, Springfield, VA

Compensation Range:The anticipated base salary range for this position is $145,000–$180,000 annually and reflects Kentro’s good-faith expectations at the time of posting. Final compensation is determined based on the role’s requirements, relevant skills, experience, education, certifications, work location, applicable security clearance requirements, market conditions, internal equity, and contract requirements.

This Job Description reflects the primary duties of the role; however, it is not intended to be all‑inclusive. Team members may be asked to take on additional responsibilities in alignment with customer expectations, business needs, and Kentro’s culture of collaboration and adaptability.

Responsibilities

Develop, write, and maintain a formal Information Systems Security Program (ISSP) that includes all applicable security Information Systems (IS) documentation in accordance with NGA/OCIO policies for up to 16 SPIDS under continuous monitoring protocols and standards, including, but not limited to: Concept of Operations (CONOPS), System Security Plans (SSPs), System Security Authorization Agreements (SSAAs), Security-related Interconnection Security Agreements (ISAs), Memorandums of Understanding/ Agreement (MOUs/MOAs), Network and system diagrams and Security Requirement Traceability Matrices (SRTMs).

Adopt and maintain a customer notification and enforcement process for implementing IS security policy changes, in coordination with the Office of Expeditionary Operations (IX) GPOCs and in coordination with IX support contractors.

Conduct periodic reviews to ensure compliance with the SSP. Conduct these compliance reviews no later than three business (3) days following notification of a reported incident.

Ensure configuration management (CM) for security-relevant IS software, hardware, and firmware is maintained and documented by means that include monthly review of firmware versions for hardware models contained in IX inventory and notify customer of required updates.

Ensure the development of system assessment documentation by reviewing and endorsing such documentation and recommending action to the Authorizing Official/Delegated Authorizing Official (AO/DAO).

Ensure approved procedures are in place for clearing, purging, declassifying, and releasing system memory, media, and output and provide procedures and SOP to GPOC and IX support contractors.

Maintain as required by the AO/DAO and other regulatory guidance, a repository for all current and historic system assessment documentation and modifications.

Coordinate and conduct IS security inspections, tests, and reviews as tasked by the IX Government Information Security Manager (GPOC) in coordination with the applicable Program/Project Manager (PM).

Develop, review, and update procedures for responding to security incidents and for investigating and reporting (to IX management, the AO/DAO Representative, and local management) security violations and incidents, as appropriate coordination with GPOC.

Ensure proper protection or corrective measures have been taken when an incident or vulnerability has been discovered within a system in coordination with GPOC.

Ensure data ownership and responsibilities are established for each IS, to include accountability, access rights, and special handling requirements.

Develop, implement, review, and update procedures for authorizing the use of software, hardware, and firmware on the system.

Formally notify the AO/DAO when a system no longer processes intelligence or SAP information.

Formally notify IX management and the AO/DAO when changes occur that might affect assessment and authorization.

Ensure that system security requirements are addressed during all phases of the system life cycle.

Develop and maintain A&A status documents.

Provide applicable security engineering input to development project documentation, requirements reviews, and design reviews and testing of the systems CONUS AND OCONUS.

Provide security engineering advice and guidance to the ISSO, ISSE, Security Control Assessor (SCA), and OCIO in support of the NGA Program Manager(s).

Maintain a knowledge base of system functions, security policies, technical security safeguards, and operational security measures.

Create and update existing Standard Operating Procedures (SOP).

Test and enforce IS security policies. Specifically: Perform tests and scans, using NGA accepted scanning tools (software and hardware), used either remotely or locally on the systems to ensure compliance and to identify security holes, risks, threats, and gaps. Completed scans will require transferring from non- networked systems to Xacta following NGA established policies for Data Transfer Officers. Write reports to include Plan of Action and Milestone (POAM) documents as a result of scanning that identifies security issues on the system. Perform on a monthly basis for up to 16 SPIDS under continuous monitoring protocols and standards with up to 1200 controls per SPID.

Review System Security Plans (SSPs), test the documented systems, and endorse those found to be acceptable.

Ensure new baseline software is added to the agency-approved whitelist using approved agency process.

Evaluate and/or create and staff, as needed, system security plans (SSPs), System Security Authorization Agreements (SSAAs), CONOPS, ISA, MOU/A, network and system diagrams, Security Requirement Traceability Matrixes (SRTMs), and other IS documentation in coordination with GPOC.

Evaluate NGA classified and unclassified IS to determine if the systems meet national, DoD, IC, and NGA security requirements for processing at the specified classification level.

Establish testing requirements, coordinate, and conduct formal assessment testing.

Perform vulnerability assessments, determine residual security risks, prepare assessment test finding reports, and provide formal authorization recommendations.

Provide Data Transfer Officer (DTO) duties for IX requests as needed.

Travel to Bluemont, VA (as needed for scanning, and DTO Support)

Education: Bachelor of Science, preferred but not required

Experience: 5+ Years of related field or work experience is estimated

Required Skills

• Valid certification to meet DoDI 8570.01-M and DoDD 8140.01 Level II requirements.
• Demonstrated experience with Risk Management Framework assessment and authorization activities and processes.
• Demonstrated experience with vulnerability management.
• Demonstrated understanding of cybersecurity best practices.
• Demonstrated technical understanding of physical, virtualized, and cloud computing.
• Demonstrated understanding of computer networking.

Preferred Qualifications

Ability to effectively communicate cybersecurity concepts to partners, stakeholders, and customers.

Clearance Requirement

TS/SCI, with polygraph or ability to obtain a polygraph

US Citizen

The Company

We believe in generating success collaboratively, enabling long-term mission success, and building trust for the next challenge. With you as our partner, let’s solve challenges, think innovatively, and maximize impact. As a valued member of our team, you have the unique opportunity to work in a diverse range of technology and business career paths, all while supporting our nation and delivering innovative technology solutions. We are a close community of experts that pride ourselves on creating an environment defined by teamwork, dedication, and excellence.

We hold three ISO certifications (27001:2013, 20000-1:2011, 9001:2015), two CMMI ML 3 ratings (DEV and SVC) and CMMC Level 2 Certification.

Industry Recognition

Growth | Inc 5000’s Fastest Growing Private Companies, DC Metro List Fastest Growing; Washington Business Journal: Fastest Growing Companies, Top Performing Small Technology Companies in Greater D.C.

Culture | Northern Virginia Technology Council Tech 100 Honoree; Virginia Best Place to Work; Washington Business Journal: Best Places to Work, Corporate Diversity Index Winner – Mid-Size Companies, Companies Owned by People of Color; Department of Labor’s HireVets for our work helping veterans transition; SECAF Award of Excellence finalist; Victory Military Friendly Brand; Virginia Values Veterans (V3); Cystic Fibrosis Foundation Corporate Breath Award

Benefits

We offer competitive benefits package including paid time off, healthcare benefits, supplemental benefits, 401k including an employer match, discount perks, rewards, and more. We invest in our employees – Every employee is eligible for education reimbursement for certifications, degrees, or professional development. Reimbursement amounts may fluctuate due to IRS limitations. We want you to grow as an expert and a leader and offer flexibility for you to take a course, complete a certification, or other professional growth and networking. We are committed to supporting your curiosity and sustaining a culture that prioritizes commitment to continuous professional development.

We work hard; we play hard. Kentro is committed to incorporating fun into every day. We dedicate funds for activities – virtual and in-person – e.g., we host happy hours, holiday events, fitness & wellness events, and annual celebrations. In alignment with our commitment to our communities, we also host and attend charity galas/events. We believe in appreciating your commitment and building a positive workspace for you to be creative, innovative, and happy.

Commitment Equal Opportunity Employment & VEVRAA

Kentro is an equal opportunity employer. All qualified applicants will receive consideration for employment without regard to disability, status as a protected veteran or any other status protected by applicable federal, state or local law.

Kentro is strongly committed to compliance with VEVRAA and other applicable federal, state, and local laws governing equal employment opportunity. We have developed comprehensive policies and procedures to ensure our hiring practices align with these requirements.

As part of our VEVRAA compliance efforts, Kentro has established an equal opportunity plan outlining our commitment to recruiting, hiring, and advancing protected veterans. This plan is regularly reviewed and updated to ensure its effectiveness.

We encourage protected veterans to self-identify during the application process. This information is strictly confidential and will only be used for reporting and compliance purposes as required by law. Providing this information is voluntary and will not impact your employment eligibility.

Our commitment to equal employment opportunity extends beyond legal compliance. We are dedicated to fostering an inclusive workplace where all employees, including protected veterans, are treated with dignity, respect, and fairness.

How to Apply

To apply to Kentro Positions- Please click on the job link and then click the blue “Apply” button at the top right of Job Description. Please upload your resume and complete all the application steps. You must fully submit the application for Kentro to consider you for a position. If you need alternative application methods, please email [email protected] and request assistance.

Accommodations

To perform this job successfully, an individual must be able to perform each essential duty satisfactorily. Reasonable Accommodations may be made to enable qualified individuals with disabilities to perform the essential functions. If you need to discuss reasonable accommodations, please email [email protected].

#LI-