InfoSec Engineer III at Quivera Enterprises in Location not listed

This position is contingent upon contract award

Wichita Tribal Enterprises, a Quivera Enterprises company, is seeking an experienced Information Security Engineer III to support the Department of the Interior (DOI), Indian Affairs (IA) Office of Information Technology (OIT). This position provides senior-level cybersecurity engineering and Risk Management Framework (RMF) support for enterprise information systems, ensuring compliance with federal cybersecurity requirements and NIST guidance.

The Information Security Engineer III serves as a subject matter expert responsible for developing security authorization packages, conducting security assessments, implementing RMF processes, developing security policies, and advising leadership on enterprise cybersecurity strategy. This role partners with federal stakeholders, project managers, and technical teams to ensure information systems remain secure, compliant, and authorized to operate.

Key Responsibilities

Risk Management Framework (RMF)

• Lead implementation of the NIST Risk Management Framework (RMF) throughout the system development lifecycle.
• Develop, maintain, and update complete authorization packages supporting Authority to Operate (ATO), Interim Authority to Test (IATT), and continuous authorization activities.
• Develop and maintain System Security Plans (SSPs), Security Assessment Plans (SAPs), Security Assessment Reports (SARs), Plans of Action and Milestones (POA&Ms), Risk Assessment Reports (RARs), Configuration Management Plans, Contingency Plans, Incident Response Plans, Privacy documentation, and supporting RMF artifacts.
• Conduct security categorization and control selection in accordance with FIPS 199, FIPS 200, NIST SP 800-37, and NIST SP 800-53.

Security Engineering & Compliance

• Perform comprehensive security assessments of technical, operational, and management controls.
• Evaluate implementation of NIST SP 800-53 security controls and document compliance findings.
• Identify system vulnerabilities and recommend risk mitigation strategies.
• Develop remediation plans and assist technical teams with corrective actions.
• Conduct vulnerability assessments and support remediation validation activities.
• Ensure compliance with applicable federal cybersecurity regulations, Department of the Interior policies, and Indian Affairs security requirements.

Information Assurance & Security Operations

• Provide technical security guidance supporting enterprise applications, infrastructure, cloud services, and industrial control systems.
• Support secure system architecture reviews and recommend security enhancements.
• Evaluate proposed system modifications to ensure security requirements are incorporated throughout the System Development Life Cycle (SDLC).
• Participate in continuous monitoring activities and support ongoing authorization requirements.
• Review security documentation for completeness, accuracy, and regulatory compliance.

Policy Development & Program Support

• Develop and maintain cybersecurity policies, standards, procedures, and Standard Operating Procedures (SOPs).
• Recommend improvements to enterprise security governance and compliance processes.
• Assist senior leadership in developing organization-wide remediation strategies for cybersecurity weaknesses.
• Provide strategic recommendations supporting the continued maturity of the Indian Affairs cybersecurity program.
• Promote a security-first culture across the organization.

Project & Stakeholder Support

• Provide cybersecurity oversight and recommendations for new and existing IT projects.
• Partner with Project Managers, System Owners, Information System Security Officers (ISSOs), Information Owners, and technical teams throughout project lifecycles.
• Coordinate with federal agencies, vendors, and cybersecurity Subject Matter Experts to remain informed of evolving technologies, threats, and regulatory changes.
• Present cybersecurity findings and risk recommendations to executive leadership.
• Support audit activities and security reviews.

Required Qualifications

• Bachelor's degree and six (6) years of relevant experience; or
• Master's degree and five (5) years of relevant experience; or
• Eight (8) years of directly related experience in lieu of a degree.
• Industry-recognized cybersecurity certification may substitute for one year of experience.
• Minimum four (4) years of full-time experience conducting security assessments and developing complete RMF authorization packages.
• Experience implementing the NIST Risk Management Framework (RMF).
• Extensive experience developing Authority to Operate (ATO) packages.
• Experience conducting risk assessments and security control assessments.
• Experience implementing and documenting NIST SP 800-53 security controls.
• Strong understanding of:
  • NIST SP 800-37
  • NIST SP 800-53
  • FIPS 199
  • FIPS 200
  • Risk Assessments
  • Configuration Management
  • Vulnerability Management
  • Contingency Planning
  • Disaster Recovery
  • Continuous Monitoring
• Experience writing security policies, procedures, and technical documentation.
• Excellent written and verbal communication skills.

Preferred Qualifications

• CISSP
• CAP (Certified Authorization Professional)
• CISM
• Security+
• CASP+
• CEH
• Experience supporting Department of the Interior, Bureau of Indian Affairs, Department of Energy, Department of Defense, or other federal agencies.
• Experience with eMASS, CSAM, Xacta, Archer, or similar Governance, Risk, and Compliance (GRC) platforms.
• Experience with cloud security and FedRAMP.
• Knowledge of industrial control systems (ICS) or operational technology (OT) security.

Education

• Bachelor's degree in Cybersecurity, Information Assurance, Computer Science, Information Systems, Engineering, or related field preferred.
• Master's degree preferred.

Equivalent education and experience combinations will be considered.

Certifications

One or more of the following certifications are highly desired:

• CISSP
• CAP
• CISM
• CASP+
• Security+
• CEH
• GSEC
• GSLC

Physical Demands – IT Office/Technical Role

The physical demands described here are representative of those that must be met by an employee, with or without reasonable accommodation.

This role is primarily office-based and requires prolonged computer use, including sitting, typing, and operating standard office equipment. Occasional walking, standing, bending, and reaching may be required to support equipment setup and troubleshooting. The employee must be able to lift up to 15 pounds, with occasional heavier lifting.

The employee must be able to communicate effectively and maintain visual acuity (close, distance, color, and depth perception). Occasional travel and extended hours may be required to support operational needs and deadlines.

Equal Employment Opportunity

Quivera Enterprises LLC and its subsidiaries are 100% tribally owned and SBA-certified Small Disadvantaged Businesses. We are proud to be an Equal Opportunity Employer and are committed to creating an inclusive workplace where all qualified applicants receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, age, disability, protected veteran status, or any other status protected by applicable federal, state, or local law.

As a tribally owned organization, Quivera Enterprises and its subsidiaries may apply Indian Preference in accordance with applicable tribal, federal, and contractual requirements where authorized by law.

Dream. Grow. Thrive.