Information System Security Engineer (ISSE)

RMF Engineering and Authorization Support

• Lead security engineering across all seven steps of the RMF lifecycle (NIST SP 800-37 Rev. 2), from categorization through continuous monitoring, for complex on-premises, cloud, and hybrid systems.
• Build security and privacy requirements into system architecture and design reviews, applying NIST SP 800-53 Rev. 5 controls, tailored baselines, and applicable overlays.
• Support to develop, review, and maintain authorization packages. These include System Security Plans (SSPs), Security Assessment Reports (SARs), Plans of Action and Milestones (POA&Ms), and supporting artifacts.
• Advise Authorizing Officials and stakeholders on risk posture, residual risk, and risk acceptance decisions.

Compliance Automation and Architecture

• Architect, configure, and administer GRC platforms (i.e. ServiceNow) and automated tools (i.e. RegScale, etc.) to automate control implementation tracking, evidence collection, assessments, and POA&M management.
• Design a compliance-as-code approach using OSCAL to create machine-readable SSPs, component definitions, assessment plans, and results.
• Integrate the eGRC platform and automated tools (i.e. RegScale) with enterprise tools through APIs. Examples include vulnerability scanners (Tenable, Qualys), SIEM (Splunk, Elastic), configuration management, CI/CD pipelines, and asset inventories. The aim is near-real-time compliance visibility.
• Where applicable, build data exchanges with authoritative government systems of record such as ServiceNow, eMASS, CSAM, or Xacta.
• Establish reusable control inheritance models, common control providers, and standardized component libraries across the client’s system portfolio.

AI-Enabled Security and Compliance

• Evaluate, pilot, and put into operation automated/AI tools that support compliance work. Uses include drafting control implementation narratives, mapping controls across frameworks, analyzing evidence, identifying gaps, and prioritizing POA&M items.
• Set up human-in-the-loop review processes, validation criteria, and quality controls so that AI-generated content is accurate, traceable, and defensible to assessors.
• Assess AI tools and systems against relevant security and governance requirements, including the NIST AI Risk Management Framework (AI RMF 1.0), applicable OMB AI guidance, and agency AI policies. Address data handling, model risk, and supply chain concerns.
• Ensure AI tool use complies with data classification, CUI handling, and FedRAMP authorization requirements.

Continuous Monitoring and Modernization

• Design and implement Information Security Continuous Monitoring (ISCM) strategies that support ongoing authorization and cATO objectives.
• Support Zero Trust Architecture initiatives aligned with federal and DoD Zero Trust strategies, and map ZT capabilities to control requirements.
• Develop dashboards and metrics that give leadership clear, current views of compliance status, risk trends, and program maturity.
• Oversee secure configuration baselines and hardening using DISA STIGs, SRGs, and CIS Benchmarks, and automate compliance verification where possible.

Technical Leadership and Collaboration

• Serve as a technical advisor to government leadership on RMF modernization and automation strategy, tool selection, and process improvement.
• Develop standard operating procedures, playbooks, and training so ISSOs and system teams can use the new automated workflows.
• Mentor junior security engineers and compliance analysts.
• Communicate complex technical and risk concepts clearly to technical and non-technical audiences.

• Bachelor’s degree in Cybersecurity, Information Systems, Computer Science, Engineering, or a related field. Equivalent experience may substitute.
• 8+ years of experience in information security, with at least 5 years of hands-on RMF implementation and ATO support for federal or DoD systems.
• Deep working knowledge of NIST SP 800-37, 800-53 Rev. 5, 800-53A, 800-137, and FIPS 199/200.
• Demonstrated experience with eGRC or compliance automation platforms, preferably ServiceNow and RegScale.
• Experience integrating security tools through REST APIs and working with structured data formats (JSON, XML, YAML).
• Scripting or automation skills in Python, PowerShell, or similar languages for compliance data processing and tool integration.
• DoD 8140 / 8570 IAT Level III or IAM Level II-III compliant certification, such as CISSP, CISM, or CGRC (formerly CAP).
• Excellent written communication skills, with a track record of producing high-quality security documentation., * Hands-on experience authoring or consuming OSCAL content.
• Experience applying generative AI or LLM tools in a regulated environment, including prompt design, output validation, and governance.
• Familiarity with FedRAMP authorization processes, including FedRAMP 20x modernization efforts.
• Knowledge of cloud security architecture in AWS GovCloud, Azure Government, or Google Cloud for Government.
• Experience with DevSecOps pipelines and embedding security gates into CI/CD workflows.
• Knowledge of CMMC, NIST SP 800-171, or the DoD Cybersecurity Reference Architecture.
• Additional certifications such as CCSP, CISSP-ISSEP, CISA, AWS/Azure security specialty, or ServiceNow/RegScale platform training/certification.

Clearance Requirement:

• Must be able to obtain and maintain a Public Trust clearance.
• US Citizen or Lawful Permanent Resident (Green Card)

Compensation Range: The pay range for this position is $150,000-180,000 annually. Kentro determines compensation by evaluating current government contracting and commercial market conditions, as well as the role’s specific requirements. Final salary placement within this range will be based on the candidate’s relevant skills, experience, education, certifications, location, and security clearance level, where applicable., We offer competitive benefits package including paid time off, healthcare benefits, supplemental benefits, 401k including an employer match, discount perks, rewards, and more. We invest in our employees - Every employee is eligible for education reimbursement for certifications, degrees, or professional development. Reimbursement amounts may fluctuate due to IRS limitations. We want you to grow as an expert and a leader and offer flexibility for you to take a course, complete a certification, or other professional growth and networking. We are committed to supporting your curiosity and sustaining a culture that prioritizes commitment to continuous professional development.

By joining our supportive community, you will find that Kentro is dedicated to your personal and professional development. Together, we can drive meaningful change, spark innovation, and achieve extraordinary milestones., We believe in generating success collaboratively, enabling long-term mission success, and building trust for the next challenge. With you as our partner, let’s solve challenges, think innovatively, and maximize impact. As a valued member of our team, you have the unique opportunity to work in a diverse range of technology and business career paths, all while supporting our nation and delivering innovative technology solutions. We are a close community of experts that pride ourselves on creating an environment defined by teamwork, dedication, and excellence.

We hold three ISO certifications (27001:2013, 20000-1:2011, 9001:2015), two CMMI ML 3 ratings (DEV and SVC) and CMMC Level 2 Certification.

Industry Recognition

Commitment Equal Opportunity Employment & VEVRAA

Kentro is an equal opportunity employer. All qualified applicants will receive consideration for employment without regard to disability, status as a protected veteran or any other status protected by applicable federal, state or local law.

Kentro is strongly committed to compliance with VEVRAA and other applicable federal, state, and local laws governing equal employment opportunity. We have developed comprehensive policies and procedures to ensure our hiring practices align with these requirements.

As part of our VEVRAA compliance efforts, Kentro has established an equal opportunity plan outlining our commitment to recruiting, hiring, and advancing protected veterans. This plan is regularly reviewed and updated to ensure its effectiveness.