> Markdown version of [/jobs/ext/4669116-cyber-security-specialist](https://www.wearedevelopers.com/jobs/ext/4669116-cyber-security-specialist). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Cyber Security Specialist - **Company:** Koniag Services, Inc. - **Location:** Oak Ridge, TN, United States - **Salary:** $110,240 - **Contract:** Permanent contract - **Skills:** Microsoft Windows, Cyber Security, Information Systems, Databases, Intrusion Detection and Prevention, Information Systems Security Architecture Professional, TCP/IP, Network Routers, SARS Software Products, Information Technology, Plan of Action and Milestones, Vulnerability Analysis - **Published:** November 11, 2026 - **Apply:** https://www.clearancejobs.com/jobs/9306194/cyber-security-specialist ## About the Role * Bachelor's degree in Cybersecurity, Computer Science, Information Technology, or related field from an accredited college or university (or equivalent experience in lieu of degree). * Significant experience in Information Technology (IT) and cybersecurity, including experience implementing or assessing cybersecurity solutions in diverse operating environments. * Experience supporting Federal RMF, system authorization, security control assessment, continuous monitoring, POA&M management, and cybersecurity risk analysis strongly preferred. * Active DOE Q clearance or DoD Top Secret (TS) clearance, or the ability to obtain one, as required for assigned duties., * Certified Information Systems Security Professional (CISSP) certification. * Thorough familiarity with DOE O 205.1, EM Cybersecurity Program Plan (CSPP), NIST SP 800-53 Rev. 5, NIST SP 800-171, DOE/EM POA&M guidance, DOE O 206.1A, NIST SP 800-82 Rev. 3, NIST SP 800-137/137A, NIST SP 800-37 Rev. 2, and applicable EOs, BODs, and DOE directives. * Functional understanding of IT and OT system components such as TCP/IP, network and host-based intrusion detection/prevention, vulnerability scanning, Windows and Unix/Linux operating systems, routers, switches, database management systems, and security tooling. * Ability to independently analyze complex technical evidence and communicate risk and recommendations to technical and executive stakeholders. * Demonstrated technical writing and report-development skills. * Excellent verbal communication, analytical, and problem-resolution skills. * Ability to manage multiple concurrent tasks and meet Government-established deadlines. * Ability to work effectively as a team member while maintaining independent professional judgment, including under the direction of a COR providing daily task assignments. * Ability to clearly distinguish advisory recommendations from Government decision-making authority and elevate matters requiring Government judgment appropriately. * Ability to report to the Oak Ridge, TN site within two (2) hours of request during business hours, as needed. Desired Skills and Competencies: * Experience supporting DOE or other Federal agency cybersecurity programs in an EM or similarly complex mission environment. * Experience with ICS/OT security assessments and NIST SP 800-82 application. * Experience supporting National Security Systems (NSS), General Support Systems (GSS), or UCNI environments. * Familiarity with CISA Known Exploited Vulnerabilities (KEV) catalog and BOD 22-01 compliance processes. * Experience coordinating HQ data calls and multi-contractor response consolidation. * Experience developing Program Management Plans (PMPs) or Quality Assurance Plans (QAPs) in a Federal contracting environment. * Additional certifications such as CISM, CAP, or Security+. ## Description * Attend cybersecurity, authorization, risk, assessment, and contractor oversight meetings with the AODR and other stakeholders as requested. * Support the AODR throughout the system authorization and continuous monitoring lifecycle, including independent technical review of authorization packages and supporting evidence. * Review System Security Plans (SSPs), security control implementation descriptions, assessment results, POA&Ms, implementation plans, impact assessments, risk categorizations, risk assessments, technical justifications, and other authorization artifacts for completeness, consistency, and technical sufficiency. * Identify cybersecurity risks, control deficiencies, evidence gaps, authorization conditions, and residual-risk considerations and provide documented analysis and recommendations. * Review proposed risk responses and POA&M content and provide recommendations concerning technical sufficiency, milestones, remediation priorities, and closure evidence. * Support tracking of authorization conditions, findings, corrective actions, POA&Ms, and other risk-treatment activities through closure or Government disposition. * Review HQ initiatives, Executive Orders, BODs, data calls, and other requirements and provide impact analyses and recommendations. * Assess the application of applicable cybersecurity requirements across the information systems and provide documented recommendations for resolution of gaps and risks. Continuous Monitoring and Security Assessments: * Plan and perform Government-authorized continuous monitoring and security control assessment activities for system boundaries, including applicable ICS/OT, NSS, GSS, UCNI, and other designated environments. Develop or support assessment plans defining scope, systems, controls, evidence, assessment methods, schedule, personnel, technical testing, and Rules of Engagement (ROE). * Use examination, interview, testing, technical validation, vulnerability analysis, and other approved assessment methods. * Perform full Security Test and Evaluation (ST&E) activities when directed by the Government. * Document assessment results in ISCM reports, SARs, ST&E reports, or other Government-approved formats. * Support follow-up validation of remediation and closure evidence for assessment findings and POA&M items. Vulnerability, KEV, and Technical Compliance Support: * Assess vulnerability and patch-management compliance for designated boundaries, including CISA Known Exploited Vulnerabilities (KEV) and BOD 22-01 requirements. Analyze scan results, missing patches/updates, configuration weaknesses, false positives, compensating controls, and remediation evidence, and provide risk-based findings and recommendations. Contractor Cybersecurity Oversight and Audit Support: * Support DOE oversight of contractor cybersecurity programs by reviewing evidence, assessing implementation of requirements, identifying gaps and risks, and providing documented recommendations. * Support coordination of cybersecurity activities associated with internal/external audits, inspections, reviews, and assessments. * Review new cybersecurity projects and significant system changes for integration of applicable requirements. * Provide recommendations for optimization and continuous improvement of cybersecurity processes, metrics, governance, and risk-management practices. HQ Data Call and Administrative Coordination Support: * Attend HQ data-call meetings as scheduled. Coordinate collection, consolidation, quality review, and status tracking of OREM contractor responses. * Track due dates and identify late, incomplete, inconsistent, or unsupported responses. * Communicate questions and clarification requests to HQ when authorized, and document responses. Prepare response packages, status reports, action trackers, and supporting documentation. * Provide administrative assistance directly related to AODR cybersecurity duties as requested. Technical Deliverables: * Prepare authorization package technical review memoranda, assessment plans, ISCM reports, SARs, POA&M review comments, vulnerability/KEV/patch analyses, risk summaries, trackers, audit-support results, HQ data-call packages, and monthly cybersecurity program status summaries in Government-approved formats, ensuring accuracy, traceability, and technical defensibility.