Abrar Admin

Karthik Consulting

<div><div><p><b>New</b>
<br>
Posted: May 18, 2026</p>
<p><i>This role is contingent upon award</i></p>
<h2 class="jobSectionHeader"><b>I. Program Overview</b></h2>
<h3 class="jobSectionHeader"><b>Program Description</b></h3>
<p>The IT CSSS program provides information security support to the Federal Bureau of Prisons Information Technology &amp; Data Division and other DOJ components as required. The program supports BOP obligations to protect federal information systems under FISMA, OMB Circular A-130, the Privacy Act, NIST RMF guidance, DOJ policy, and related cybersecurity requirements.</p>
<h3 class="jobSectionHeader"><b>Program Scope</b></h3>
<p>The program covers ATO maintenance and rapid ATO activities, RMF lifecycle support, JCAM-based authorization management, FISMA/FISCAM audit support, security architecture and engineering support, vulnerability and risk management, privacy documentation, FedRAMP assessment support, continuous monitoring, and coordination with BOP system owners, CORs, AOs, and technical stakeholders.</p>
<h2 class="jobSectionHeader"><b>II. Position Overview</b></h2>
<p>The Senior ISSO supports BOP and DOJ cybersecurity authorization, compliance, and continuous monitoring activities for federal information systems. The role develops, maintains, and assesses SA&amp;A packages; supports ATO maintenance and rapid ATO efforts; coordinates with system owners, assessors, technical teams, and government stakeholders; and ensures cybersecurity documentation, risk decisions, and control evidence remain accurate, defensible, and aligned to federal requirements.</p>
<h3 class="jobSectionHeader"><b>Work Environment</b></h3>
<ul><li>Work Location: BOP Central Office, Washington, DC; in-office required, telework as approved</li>
<li>Security Clearance: Public Trust / Suitability</li>
</ul><h2 class="jobSectionHeader"><b>III. Key Responsibilities</b></h2>
<h3 class="jobSectionHeader"><b>RMF and ATO Lifecycle Support</b></h3>
<ul><li>Develop, maintain, and assess SA&amp;A packages supporting ATO, re-ATO, ongoing authorization, and rapid authorization activities for BOP information systems.</li>
<li>Support RMF preparation, categorization, control selection, implementation, assessment, authorization, and continuous monitoring in accordance with DOJ and BOP requirements.</li>
<li>Use JCAM and government processes to document system registration, categorization, control baselines, authorization status, and required ATO artifacts.</li>
<li>Assemble authorization packages, including SSPP/SSP artifacts, SARs, POA&amp;Ms, residual risk reports, risk analysis reports, executive briefings, and authorization documentation.</li>
</ul><h3 class="jobSectionHeader"><b>Security Control Assessment and Documentation</b></h3>
<ul><li>Develop and maintain assessment plans, control documentation, implementation statements, test evidence, and assessment results.</li>
<li>Assess security and privacy controls against NIST SP 800-53, DOJ Cybersecurity Standards, BOP policy, and applicable federal guidance.</li>
<li>Identify documentation gaps, validate evidence, and coordinate corrective actions with system owners, engineers, assessors, and government stakeholders.</li>
<li>Update SSPP/SSP, SAR, POA&amp;M, contingency plan, incident response plan, configuration management plan, privacy, and supporting artifacts as system conditions change.</li>
</ul><h3 class="jobSectionHeader"><b>Risk, POA&amp;M, and Continuous Monitoring</b></h3>
<ul><li>Track and report cybersecurity risks, vulnerabilities, weaknesses, and remediation activities through POA&amp;M closure, risk acceptance, or corrective action.</li>
<li>Support ongoing authorization by monitoring system and environment changes, initiating security and privacy impact analysis, and updating artifacts as required.</li>
<li>Prepare security and privacy status reporting on system security posture, major risks, vulnerability status, POA&amp;M progress, and key authorization activities.</li>
<li>Coordinate with vulnerability management, SIEM, compliance, configuration management, and technical teams to collect evidence and support near real-time risk management.</li>
</ul><h3 class="jobSectionHeader"><b>Stakeholder Coordination and Reporting</b></h3>
<ul><li>Coordinate with BOP system owners, CORs, AOs, SCOP/privacy officials, assessors, technical teams, and contractor leadership to resolve authorization risks.</li>
<li>Prepare cybersecurity briefings, risk summaries, status updates, and decision support materials for government stakeholders and program leadership.</li>
<li>Support monthly status reporting by documenting completed activities, deliverables, risks, issues, corrective actions, and staffing or performance considerations.</li>
<li>Provide senior-level cybersecurity guidance regarding SA&amp;A readiness, ATO package quality, risk communication, and compliance expectations.</li>
</ul><h2 class="jobSectionHeader"><b>IV. Qualifications</b></h2>
<h3 class="jobSectionHeader"><b>Education</b></h3>
<ul><li>Bachelor&rsquo;s degree required.</li>
<li>Degree in cybersecurity, information systems, computer science, information technology, management information systems, or a related discipline preferred.</li>
</ul><h3 class="jobSectionHeader"><b>Professional Certifications</b></h3>
<p>Candidate must possess at least one of the following required certifications:</p>
<ul><li>CISA &ndash; Certified Information Systems Auditor.</li>
<li>CRISC &ndash; Certified in Risk and Information Systems Control.</li>
<li>CISSP &ndash; Certified Information Systems Security Professional.</li>
<li>CGRC &ndash; Certified in Governance, Risk and Compliance.</li>
</ul><h3 class="jobSectionHeader"><b>Minimum Qualifications</b></h3>
<ul><li>Minimum of seven (7) years of cybersecurity experience.</li>
<li>Minimum of six (6) years developing, maintaining, and assessing SA&amp;A packages resulting in an ATO for IT systems.</li>
<li>Experience supporting RMF, ATO maintenance, continuous monitoring, POA&amp;M management, control assessment, and security authorization documentation.</li>
<li>Experience preparing or maintaining SSP/SSPP, SAR, POA&amp;M, risk assessment, residual risk, incident response, contingency planning, configuration management, privacy, and authorization package artifacts.</li>
<li>Ability to coordinate with system owners, technical teams, assessors, authorizing officials, privacy stakeholders, CORs, and program leadership.</li>
<li>Public Trust / Suitability required; must be able to obtain and maintain required access for the duration of assignment.</li>
</ul><h3 class="jobSectionHeader"><b>Preferred Qualifications</b></h3>
<ul><li>Prior DOJ, BOP, or federal law enforcement cybersecurity support experience.</li>
<li>Experience using DOJ JCAM or similar governance, risk, and compliance systems to manage authorization artifacts and evidence.</li>
<li>Working knowledge of NIST SP 800-37, NIST SP 800-53, FISMA, FISCAM, OMB Circular A-130, Privacy Act requirements, DOJ cybersecurity policy, and FedRAMP concepts.</li>
<li>Experience supporting on-premises, cloud, hybrid, or air-gapped federal systems.</li>
<li>Strong written communication skills with the ability to produce audit-ready cybersecurity documentation and executive-level risk summaries.</li>
</ul></div><div><div><div><div><b>Job Category: </b>Analyst Cybersecurity Security
</div><div><b>Job Type: </b>Full Time
</div><div><b>Job Location: </b>Washington DC
</div><div><b>Education: </b>Bachelor's Degree
</div><div><b>Clearance: </b>Public Trust Clearance</div></div></div></div></div>

Senior Information System Security Officer (ISSO) (Cybersecurity Analyst III)

<div><div><p><b>New</b>
<br>
Posted: May 18, 2026</p>
<p><i>This role is contingent upon award</i></p>
<h2 class="jobSectionHeader"><b>I. Program Overview</b></h2>
<h3 class="jobSectionHeader"><b>Program Description</b></h3>
<p>The IT CSSS program provides information security support to the Federal Bureau of Prisons Information Technology &amp; Data Division and other DOJ components as required. The program supports BOP obligations to protect federal information systems under FISMA, OMB Circular A-130, the Privacy Act, NIST RMF guidance, DOJ policy, and related cybersecurity requirements.</p>
<h3 class="jobSectionHeader"><b>Program Scope</b></h3>
<p>The program covers ATO maintenance and rapid ATO activities, RMF lifecycle support, JCAM-based authorization management, FISMA/FISCAM audit support, security architecture and engineering support, vulnerability and risk management, privacy documentation, FedRAMP assessment support, continuous monitoring, and coordination with BOP system owners, CORs, AOs, and technical stakeholders.</p>
<h2 class="jobSectionHeader"><b>II. Position Overview</b></h2>
<p>The Senior ATO Subject Matter Expert supports BOP and DOJ cybersecurity authorization activities by leading system security assessments, preparing authorization documentation, and advising on security upgrades, policy alignment, and risk-based authorization decisions. The role supports live networks, desktop systems, servers, enterprise databases, cloud, hybrid, and classified environments as required, ensuring security A&amp;A and ATO activities are accurate, compliant, and aligned to federal and DOJ requirements.</p>
<h3 class="jobSectionHeader"><b>Work Environment</b></h3>
<ul><li>Work Location: BOP Central Office, Washington, DC; in-office required, telework as approved</li>
<li>Security Clearance: Public Trust / Suitability</li>
</ul><h2 class="jobSectionHeader"><b>III. Key Responsibilities</b></h2>
<h3 class="jobSectionHeader"><b>ATO and Authorization Lifecycle Leadership</b></h3>
<ul><li>Lead security A&amp;A and ATO activities for information systems across live networks, desktop systems, servers, enterprise databases, and classified or sensitive environments as assigned.</li>
<li>Develop, maintain, and assess authorization packages that support successful certification and accreditation, security authorization, reauthorization, and ongoing authorization decisions.</li>
<li>Apply NIST SP 800-37 RMF processes and DOJ/BOP authorization procedures to support prepare, categorize, select, implement, assess, authorize, and monitor activities.</li>
<li>Use JCAM or similar authorization management systems to document system information, control baselines, authorization evidence, risk decisions, and approval status.</li>
</ul><h3 class="jobSectionHeader"><b>System Security Assessment and Documentation</b></h3>
<ul><li>Perform system security assessments and prepare assessment-ready documentation for security controls, implementation status, technical evidence, and identified weaknesses.</li>
<li>Prepare, review, and update SSPP/SSP, SAR, POA&amp;M, residual risk, risk analysis, threat matrix, authorization memo, and executive briefing artifacts.</li>
<li>Assess system boundaries, information types, categorization decisions, control implementation details, and supporting evidence for accuracy and completeness.</li>
<li>Coordinate updates to incident response, contingency planning, configuration management, privacy, MOU/ISA, and other RMF-related documentation as required.</li>
</ul><h3 class="jobSectionHeader"><b>Security Policy, Compliance, and Risk Advisory</b></h3>
<ul><li>Assess and enhance IT security policies and procedures in response to federal, DOJ, BOP, and international regulatory requirements as applicable.</li>
<li>Apply strong working knowledge of NIST Special Publications, NIST SP 800-53 security control selection, and federal cybersecurity requirements to improve authorization readiness.</li>
<li>Analyze security findings, vulnerabilities, policy gaps, and control deficiencies to determine risk impact and recommend corrective actions or risk response options.</li>
<li>Support risk-based decision-making by translating security assessment results into clear recommendations for system owners, AOs, CORs, and program leadership.</li>
</ul><h3 class="jobSectionHeader"><b>Security Upgrades and Technical Coordination</b></h3>
<ul><li>Coordinate with system owners, operations and maintenance teams, engineers, and assessors to support security upgrades and remediation activities for operational systems.</li>
<li>Review proposed system and environment changes to determine potential security or privacy impact and required updates to authorization artifacts.</li>
<li>Support vulnerability remediation, control implementation validation, and technical evidence collection across on-premises, cloud, hybrid, and air-gapped environments.</li>
<li>Ensure security documentation reflects the as-implemented state of systems and remains current as technologies, configurations, and mission requirements evolve.</li>
</ul><h3 class="jobSectionHeader"><b>Reporting, Stakeholder Engagement, and Quality Control</b></h3>
<ul><li>Prepare written communications, status updates, briefings, risk summaries, and authorization decision support materials for government and contractor leadership.</li>
<li>Support monthly reporting by documenting deliverables, risks, issues, corrective actions, authorization milestones, and system security posture.</li>
<li>Coordinate with BOP system owners, CORs, AOs, privacy stakeholders, assessors, and technical teams to resolve documentation gaps and authorization risks.</li>
<li>Maintain high-quality, audit-ready artifacts that meet SOW requirements for content, completeness, accuracy, and conformance.</li>
</ul><h2 class="jobSectionHeader"><b>IV. Qualifications</b></h2>
<h3 class="jobSectionHeader"><b>Education</b></h3>
<ul><li>Bachelor&rsquo;s degree required.</li>
<li>Degree in cybersecurity, information systems, computer science, information technology, management information systems, or a STEM related discipline preferred.</li>
</ul><h3 class="jobSectionHeader"><b>Professional Certifications</b></h3>
<p>Candidate must possess at least one of the following required certifications:</p>
<ul><li>CISA &ndash; Certified Information Systems Auditor.</li>
<li>CRISC &ndash; Certified in Risk and Information Systems Control.</li>
<li>CISSP &ndash; Certified Information Systems Security Professional.</li>
<li>CAP &ndash; Certified Authorization Professional.</li>
</ul><h3 class="jobSectionHeader"><b>Minimum Qualifications</b></h3>
<ul><li>Minimum of seven (7) years of experience performing systems security assessments, preparing system security documentation, and/or performing security upgrades for live networks, desktop systems, servers, and enterprise databases leading to successful certification and accreditation or security authorization.</li>
<li>Minimum of seven (7) years of experience assessing and enhancing IT systems security policies and procedures in response to regulatory requirements associated with federal and international standards.</li>
<li>Minimum of seven (7) years of IT security experience with extensive knowledge of security regulations and security assessments, including experience developing security A&amp;A and ATO packages for a range of systems, including classified systems.</li>
<li>Experience supporting RMF, ATO maintenance, security authorization documentation, control assessment, risk analysis, POA&amp;M management, and ongoing authorization activities.</li>
<li>Ability to coordinate with system owners, technical teams, assessors, authorizing officials, privacy stakeholders, CORs, and program leadership.</li>
<li>Public Trust / Suitability required; must be able to obtain and maintain required access for the duration of the assignment.</li>
</ul><h3 class="jobSectionHeader"><b>Preferred Qualifications</b></h3>
<ul><li>Strong working knowledge of NIST Special Publications, including NIST SP 800-53 for security control selection and NIST SP 800-37 for RMF/security authorization.</li>
<li>Experience using DOJ JCAM or similar governance, risk, and compliance systems to manage authorization artifacts, evidence, and authorization status.</li>
<li>Prior DOJ, BOP, or federal law enforcement cybersecurity support experience.</li>
<li>Experience supporting on-premises, cloud, hybrid, air-gapped, or classified federal systems.</li>
<li>Strong written communication skills with the ability to produce audit-ready cybersecurity documentation and executive-level risk summaries.</li>
</ul></div><div><div><div><div><b>Job Category: </b>Analyst Cybersecurity Security SME
</div><div><b>Job Type: </b>Full Time
</div><div><b>Job Location: </b>Washington DC
</div><div><b>Education: </b>Bachelor's Degree
</div><div><b>Clearance: </b>Public Trust Clearance</div></div></div></div></div>

Senior ATO Subject Matter Expert Cybersecurity Analyst III

<div><div><p><b>New</b>
<br>
Posted: May 18, 2026</p>
<p><i>This role is contingent upon award</i></p>
<h2 class="jobSectionHeader"><b>I. Program Overview</b></h2>
<h3 class="jobSectionHeader"><b>Program Description</b></h3>
<p>The IT CSSS program provides information security support to the Federal Bureau of Prisons Information Technology &amp; Data Division and other DOJ components as required. The program supports BOP obligations to protect federal information systems under FISMA, OMB Circular A-130, the Privacy Act, NIST RMF guidance, DOJ policy, and related cybersecurity requirements.</p>
<h3 class="jobSectionHeader"><b>Program Scope</b></h3>
<p>The program covers ATO maintenance and rapid ATO activities, RMF lifecycle support, JCAM-based authorization management, FISMA/FISCAM audit support, security architecture and engineering support, vulnerability and risk management, privacy documentation, FedRAMP assessment support, continuous monitoring, and coordination with BOP system owners, CORs, AOs, and technical stakeholders.</p>
<h2 class="jobSectionHeader"><b>II. Position Overview</b></h2>
<p>The Security Control Assessor/Analyst supports BOP and DOJ cybersecurity authorization activities by assessing security controls, validating evidence, analyzing risk, and preparing assessment documentation for classified and unclassified systems, including National Security Systems. This role supports RMF, ATO maintenance, continuous monitoring, and security authorization activities by ensuring assessments are technically sound, properly documented, and aligned with NIST SP 800-53A, DOJ/BOP requirements, and program delivery expectations.</p>
<h3 class="jobSectionHeader"><b>Work Environment</b></h3>
<ul><li>Work Location: BOP Central Office, Washington, DC; in-office required, telework as approved</li>
<li>Security Clearance: Public Trust / Suitability</li>
</ul><h2 class="jobSectionHeader"><b>III. Key Responsibilities</b></h2>
<h3 class="jobSectionHeader"><b>Security Control Assessment</b></h3>
<ul><li>Assess security and privacy controls for classified and unclassified systems, including National Security Systems, in accordance with NIST SP 800-53A, DOJ/BOP requirements, and approved assessment plans.</li>
<li>Validate implementation evidence, test results, artifacts, and technical documentation to determine whether controls are implemented correctly, operating as intended, and producing the desired security outcome.</li>
<li>Document assessment results, findings, deficiencies, recommendations, and risk implications in Security Assessment Reports and related authorization artifacts.</li>
<li>Coordinate with ISSOs, system owners, engineers, and authorization stakeholders to resolve control assessment questions and evidence gaps.</li>
</ul><h3 class="jobSectionHeader"><b>RMF, ATO, and Authorization Support</b></h3>
<ul><li>Support RMF lifecycle activities for ATO maintenance, rapid ATOs, reauthorization, ongoing authorization, and continuous monitoring.</li>
<li>Review authorization package content, including SSPP/SSP, SAR, POA&amp;M, residual risk reports, risk analysis reports, threat matrix reports, and executive briefings.</li>
<li>Use JCAM or similar authorization management systems to review control implementation data, assessment records, evidence, and authorization status.</li>
<li>Support AO and stakeholder decision-making by providing clear assessment findings and risk-based recommendations.</li>
</ul><h3 class="jobSectionHeader"><b>Classified, Unclassified, and NSS Security Assessment Support</b></h3>
<ul><li>Apply specialized cybersecurity assessment expertise across classified programs, unclassified programs, National Security Systems, and sensitive federal environments as assigned.</li>
<li>Evaluate system boundaries, security categorization, control applicability, inherited controls, hybrid controls, and assessment scope to support accurate authorization decisions.</li>
<li>Assess live networks, system components, cloud or hybrid environments, and enterprise services to determine security posture and compliance readiness.</li>
<li>Ensure assessment work reflects the operational environment, mission use, technical architecture, and applicable federal security requirements.</li>
</ul><h3 class="jobSectionHeader"><b>Risk, Vulnerability, and POA&amp;M Analysis</b></h3>
<ul><li>Analyze control weaknesses, vulnerabilities, audit findings, and technical deficiencies to determine severity, risk impact, and recommended remediation approach.</li>
<li>Support POA&amp;M creation, review, validation, tracking, and closure by ensuring weaknesses are clearly documented and tied to corrective actions.</li>
<li>Review remediation evidence and updated assessment results to determine whether findings can be reduced, closed, or escalated for risk acceptance consideration.</li>
<li>Coordinate with vulnerability management, incident response, configuration management, and O&amp;M teams to align findings with operational remediation activities.</li>
</ul><h3 class="jobSectionHeader"><b>Reporting, Documentation, and Stakeholder Coordination</b></h3>
<ul><li>Prepare written communications, assessment summaries, status updates, findings reports, and briefing materials for government and contractor leadership.</li>
<li>Support monthly reporting by documenting assessment progress, deliverables, risks, issues, corrective actions, and key authorization activities.</li>
<li>Maintain audit-ready documentation that meets SOW requirements for content, completeness, accuracy, and conformance.</li>
<li>Communicate technical assessment results in clear language for system owners, CORs, AOs, privacy stakeholders, and program leadership.</li>
</ul><h2 class="jobSectionHeader"><b>IV. Qualifications</b></h2>
<h3 class="jobSectionHeader"><b>Education</b></h3>
<ul><li>Bachelor&rsquo;s degree required.</li>
<li>Degree in cybersecurity, information systems, computer science, information technology, management information systems, or a related discipline preferred.</li>
</ul><h3 class="jobSectionHeader"><b>Professional Certifications</b></h3>
<p>Candidate must possess at least one of the following required certifications:</p>
<ul><li>CISA &ndash; Certified Information Systems Auditor.</li>
<li>CRISC &ndash; Certified in Risk and Information Systems Control.</li>
<li>CISSP &ndash; Certified Information Systems Security Professional.</li>
<li>CGRC &ndash; Certified in Governance, Risk and Compliance.</li>
</ul><h3 class="jobSectionHeader"><b>Minimum Qualifications</b></h3>
<ul><li>Minimum of eight (8) years of cybersecurity expertise.</li>
<li>Minimum of five (5) years of specialized experience supporting classified and unclassified programs, National Security Systems, and NIST SP 800-53A security control assessment activities.</li>
<li>Experience performing security control assessments, validating assessment evidence, documenting findings, and supporting authorization decisions for federal information systems.</li>
<li>Experience supporting RMF, ATO maintenance, control assessment, risk analysis, POA&amp;M management, and continuous monitoring activities.</li>
<li>Ability to coordinate with system owners, ISSOs, engineers, assessors, authorizing officials, privacy stakeholders, CORs, and program leadership.</li>
<li>Public Trust / Suitability required; must be able to obtain and maintain required access for the duration of the assignment.</li>
</ul><h3 class="jobSectionHeader"><b>Preferred Qualifications</b></h3>
<ul><li>Strong working knowledge of NIST Special Publications, including NIST SP 800-53A assessment procedures, NIST SP 800-53 security controls, and NIST SP 800-37 RMF/security authorization.</li>
<li>Experience using DOJ JCAM or similar governance, risk, and compliance systems to review authorization artifacts, assessment evidence, and authorization status.</li>
<li>Prior DOJ, BOP, DoD, Intelligence Community, or federal law enforcement cybersecurity assessment experience.</li>
<li>Experience assessing controls for on-premises, cloud, hybrid, air-gapped, or classified federal systems.</li>
<li>Strong written communication skills with the ability to produce audit-ready assessment documentation and executive-level risk summaries.</li>
</ul></div><div><div><div><div><b>Job Category: </b>Analyst Cybersecurity Security
</div><div><b>Job Type: </b>Full Time
</div><div><b>Job Location: </b>Washington DC
</div><div><b>Education: </b>Bachelor's Degree
</div><div><b>Clearance: </b>Public Trust Clearance</div></div></div></div></div>

Security Control Assessor/Analyst (Cybersecurity Analyst III)

Join Karthik Consulting and explore 3   exciting career opportunities. They're hiring for various roles with options for remote or on-site work. Apply today and become part of their innovative team.

Karthik Consulting

About Company

Senior Information System Security Officer (ISSO) (Cybersecurity Analyst III)

Senior ATO Subject Matter Expert Cybersecurity Analyst III

Security Control Assessor/Analyst (Cybersecurity Analyst III)