DOJ - Lead ATO SME - Top Secret Required

cFocus Software seeks a Lead ATO SME to join our program supporting the Department of Justice (DOJ). This position is on-site in Washington, DC. This position requires a Top-Secret clearance.

Qualifications:

• Active Top-Secret clearance
• 10 years of experience in IT Project Management in both Waterfall and Agile environments.
• 10 years of experience performing systems security assessments, preparing system security documentation, and/or performing security upgrades for live networks, desktop systems, servers, and enterprise data bases leading to successful certification and accreditation or security authorization of such systems.
• 10 years of experience assessing and enhancing IT systems security policies and procedures in response to the regulatory requirements associated with Federal and International standards.
• 10 years of IT Security experience with extensive knowledge in security regulations and security assessments having developed numerous security A&A and ATO on a range of systems including classified systems.
• Strong working knowledge with NIST Special Publications, NIST 800-53 for security control selection and NIST SP 800-37 SA using JCAM system is preferred.
• Minimum of two of the following certifications:
• CISA, CRISC, CISM, CGEIT, CISSP, CAP

Duties:

• Ensure all deliverables meet DOJ quality, completeness, and acceptance standards.
• Provide mentorship and technical guidance to Senior ATO SMEs and supporting engineers.
• Ensure compliance with classified and Controlled Unclassified Information (CUI) handling requirements.
• Support audits, inspections, and government reviews as required.
• Serve as the technical lead for end-to-end Risk Management Framework (RMF) execution supporting Authority to Test (ATT), Authority to Operate (ATO), and Continuous Monitoring (ConMon).
• Provide technical direction, quality assurance, and subject-matter leadership across all RMF phases in accordance with NIST SP 800-37, NIST SP 800-53, DOJ Cybersecurity Standards, and DOJ Security and Privacy Assessment and Authorization Handbook.
• Act as the primary technical interface between the contractor team, Authorizing Officials (AO), Senior Agency Officials for Privacy (SCOP), COR, and system stakeholders.
• Lead system preparation activities, including mission and business process identification, stakeholder identification, and asset inventory.
• Define system authorization boundaries and operational environments.
• Ensure system registration and documentation within the Joint Cybersecurity Assessment and Management (JCAM) system.
• Conduct and maintain system-level risk assessments and ensure security and privacy requirements are defined and allocated appropriately.
• Oversee development and validation of system descriptions, boundaries, and characteristics.
• Lead security categorization activities in accordance with FIPS 199 and DOJ requirements, including confidentiality, integrity, and availability impact analyses.
• Ensure identification and documentation of Personally Identifiable Information (PII) and coordination of Initial Privacy Assessments (IPA).
• Coordinate categorization reviews and approvals with the AO and SCOP and ensure final concurrence is documented in JCAM.
• Lead selection of baseline security and privacy controls using DOJ Cybersecurity Standard 0904 and NIST SP 800-53.
• Oversee control tailoring, scoping, and allocation decisions based on mission, risk tolerance, system architecture, and operational environment.
• Ensure justification for tailored controls is properly documented in the System Security and Privacy Plan (SSPP).
• Direct development and approval of the Information Security Continuous Monitoring (ISCM) Plan.
• Ensure SSPP and Requirements Traceability Matrix (RTM) are generated, reviewed, approved, and uploaded into JCAM.
• Provide technical oversight for implementation of system, hybrid, and common security and privacy controls.
• Ensure controls are implemented in accordance with DOJ standards and minimum assurance requirements.
• Review and approve use of compensating controls and associated POA&Ms, ensuring AO and SCOP concurrence when required.
• Ensure system documentation (SSPP, Incident Response Plan, Contingency Plan, Configuration Management Plan, privacy artifacts) reflects the “as-implemented” control state.
• Lead development and approval of Security Assessment Plans (SAPs).
• Oversee execution of security and privacy control assessments using automated and manual assessment techniques.
• Review Security and Privacy Assessment Reports (SARs) for accuracy, completeness, and risk clarity.
• Direct remediation analysis, severity determination, and corrective action planning.
• Ensure development, maintenance, and tracking of Plans of Action and Milestones (POA&Ms).
• Assemble and validate complete authorization packages, including SSPP, SAR, POA&Ms, risk analysis, residual risk reports, and executive briefings.
• Brief Authorizing Officials on system security posture, residual risks, and recommended risk responses.
• Support AO decision-making for ATO, Interim ATO, or denial of authorization.
• Ensure authorization decisions and signed ATO memoranda are properly recorded in JCAM.
• Lead Continuous Monitoring (ConMon) activities, ensuring assessment of one-third of controls annually and Re-ATO every three years.
• Oversee configuration management, change control, and security impact analyses for system and environment changes.
• Ensure timely updates to SSPP, SAR, POA&Ms, risk reports, and authorization artifacts.
• Direct ongoing risk response actions and reporting to AO and stakeholders.
• Oversee system disposal activities, including development of decommissioning and retirement documentation.
• Ensure all cloud services used by BOP systems maintain valid FedRAMP authorization (SaaS, PaaS, IaaS).
• Oversee review and validation of FedRAMP security packages and inheritance models.
• Ensure cloud security posture aligns with DOJ, NIST, and FedRAMP requirements.