Find Your Next Opportunity at Delviom

Information System Security Officer (ISSO)

2 Years

Position Overview

Delviom is seeking a Junior Information System Security Officer (ISSO) to support cybersecurity operations, Risk Management Framework (RMF) activities, and security compliance for a federal government program in Washington, DC. The ideal candidate will have a foundational understanding of information system security, NIST security controls, vulnerability management, and security authorization processes.

This position offers an opportunity to gain hands-on experience supporting federal information systems, maintaining security documentation, and working closely with senior ISSOs, security engineers, and government stakeholders.

Key Responsibilities

• Support implementation and ongoing monitoring of security controls in accordance with NIST SP 800-53 and NIST RMF.

• Assist with the Authorization to Operate (ATO) process, including preparation and maintenance of security authorization documentation.

• Support development and updates of System Security Plans (SSPs), Plans of Action and Milestones (POA&Ms), Security Assessment Reports (SARs), and other RMF artifacts.

• Assist in conducting vulnerability assessments, reviewing scan results, and tracking remediation activities.

• Monitor system security configurations, access controls, audit logs, and compliance requirements.

• Support continuous monitoring (ConMon), security control assessments, and periodic security reviews.

• Assist with maintaining security documentation and collecting evidence for audits and assessments.

• Track security findings, coordinate remediation efforts, and maintain POA&M status.

• Support incident reporting, risk assessments, and security impact analysis for system changes.

• Work with system administrators, engineers, and cybersecurity teams to ensure systems maintain compliance with federal security requirements.

Required Qualifications

• Active Top Secret (TS) security clearance.

• Minimum 2 years of professional experience in cybersecurity, information security, or IT security operations.

• Basic understanding of NIST RMF, NIST SP 800-53, and federal cybersecurity requirements.

• Familiarity with security control implementation, vulnerability management, and security compliance.

• Basic knowledge of SSPs, POA&Ms, ATO processes, and continuous monitoring.

• Understanding of Windows/Linux operating systems, network security, and access management.

• Strong documentation, analytical, and communication skills.

• Ability to work onsite in Washington, DC, five days per week.

Preferred Qualifications

• Security+ certification or equivalent cybersecurity certification.

• Familiarity with FISMA, NIST SP 800-37, and NIST SP 800-53.

• Exposure to vulnerability scanning tools such as Nessus or Tenable.

• Familiarity with security compliance tools such as eMASS, CSAM, or similar GRC platforms.

• Experience supporting federal government cybersecurity programs.

• Understanding of security principles such as least privilege, multifactor authentication, encryption, and audit logging.

Posted October 15, 2026

Lead Incident Detection / Response Manager

10+ Years, Active Top Secret Clearance

Position Overview

We are seeking an experienced Incident Detection / Response Manager IV – Lead to oversee enterprise cybersecurity incident detection, response, investigation, and recovery activities for a federal government program. The ideal candidate will have extensive experience managing Security Operations Center (SOC) functions, leading complex cybersecurity investigations, coordinating incident response teams, and managing critical security incidents across enterprise environments.

The role requires strong technical expertise in threat detection, incident handling, digital forensics, security operations, and federal cybersecurity compliance, along with demonstrated leadership in high-pressure incident response situations.

Key Responsibilities

• Lead enterprise cybersecurity incident detection, investigation, containment, eradication, recovery, and post-incident activities.

• Direct incident response teams handling ransomware, malware, phishing, credential compromise, insider threats, data breaches, and advanced cyberattacks.

• Develop and maintain incident response procedures, escalation protocols, response playbooks, and operational workflows aligned with NIST SP 800-61.

• Oversee SOC operations, security event monitoring, incident prioritization, threat analysis, and critical incident escalation.

• Coordinate digital forensic investigations, root cause analysis, evidence preservation, and remediation activities with technical teams.

• Manage incident response activities involving on-premises infrastructure, cloud environments, endpoints, networks, and enterprise applications.

• Oversee the operational use of SIEM, SOAR, EDR, vulnerability management, and incident management platforms, including Splunk, Microsoft Sentinel, CrowdStrike, and ServiceNow.

• Coordinate with security engineers, infrastructure teams, cloud specialists, and federal stakeholders to resolve security incidents and reduce operational risks.

• Establish and track incident response KPIs, response times, incident trends, corrective actions, and operational performance metrics.

• Prepare executive-level incident reports, security briefings, root cause findings, and recommendations for improving enterprise security posture.

• Manage critical incident notifications, reporting timelines, recovery priorities, and federal cybersecurity reporting obligations.

• Lead incident response readiness exercises, tabletop simulations, lessons-learned reviews, and continuous improvement initiatives.

Required Qualifications

• Minimum 10 years of progressive cybersecurity experience, including significant experience leading incident detection and response teams.

• Proven experience managing enterprise-level incident response programs, SOC operations, and security investigations.

• Strong understanding of NIST SP 800-61, NIST Cybersecurity Framework (CSF), and federal cybersecurity incident response requirements.

• Demonstrated expertise investigating ransomware, malware, phishing, insider threats, credential compromise, and sophisticated cyberattacks.

• Hands-on knowledge of SIEM, SOAR, EDR, digital forensics, threat intelligence, and vulnerability management technologies.

• Experience coordinating incident containment, forensic analysis, root cause investigations, system recovery, and corrective action implementation.

• Experience developing operational procedures, incident response playbooks, executive reports, and incident management dashboards.

• Strong leadership, stakeholder coordination, crisis management, and communication skills.

• Ability to support remote operations and travel occasionally to Washington, DC, when required.

Preferred Qualifications

• Certifications such as CISSP, CISM, GCIH, GCFA, GCFE, or equivalent.

• Experience supporting federal civilian agencies or large government cybersecurity programs.

• Familiarity with FISMA, FedRAMP, NIST SP 800-53, and federal incident reporting requirements.

• Experience managing large-scale cybersecurity incidents in hybrid cloud and enterprise environments.

• Knowledge of MITRE ATT&CK, threat hunting, security automation, and incident response maturity assessments.

Junior Risk Management Framework Analyst

2+ Years of Cybersecurity Experience, Active Top Secret (TS) Required

Position Summary

Delviom is seeking a Junior Risk Management Framework (RMF) Analyst to support cybersecurity risk management, security control assessments, and Authorization to Operate (ATO) activities for a federal government program.

The candidate will support the complete NIST Risk Management Framework (RMF) lifecycle, with a primary focus on Security Control Assessor (SCA) responsibilities, including reviewing system security documentation, evaluating the implementation and effectiveness of security controls, conducting security assessments, validating technical and administrative evidence, identifying security weaknesses, documenting assessment findings, and supporting authorization decisions.

The role involves assisting with the development and execution of Security Assessment Plans (SAPs), performing security control testing using NIST SP 800-53A assessment procedures, documenting results in Security Assessment Reports (SARs), reviewing System Security Plans (SSPs), evaluating vulnerability scan results, validating Plans of Action and Milestones (POA&Ms), and supporting risk assessments, continuous monitoring, and periodic security reassessments.

The Junior RMF Analyst will work closely with senior SCAs, ISSOs, system owners, security engineers, and Authorizing Official (AO) representatives to evaluate security compliance, assess residual risks, validate remediation activities, and ensure authorization packages contain accurate, complete, and defensible security assessment evidence.

Key Responsibilities

• Support security control assessments in accordance with NIST SP 800-37, NIST SP 800-53, and NIST SP 800-53A.

• Assist in evaluating management, operational, technical, and privacy security controls through examination, interviews, and testing.

• Review System Security Plans (SSPs) to verify control implementation descriptions, system boundaries, security responsibilities, and supporting documentation.

• Assist in preparing and executing Security Assessment Plans (SAPs), including assessment procedures, testing methods, and evidence requirements.

• Document security assessment findings, control deficiencies, and risk observations in Security Assessment Reports (SARs).

• Review vulnerability assessment results from tools such as Tenable Nessus, ACAS, and other security scanning platforms.

• Assist with evaluating POA&Ms, including remediation plans, risk ratings, corrective actions, and closure evidence.

• Validate security control implementation through configuration reviews, policy and procedure assessments, audit log examinations, and technical evidence analysis.

• Support risk assessments, security impact analyses, control inheritance reviews, and identification of residual risks.

• Assist with ATO package reviews, security authorization readiness activities, and recommendations supporting authorization decisions.

• Participate in continuous monitoring activities, periodic control assessments, vulnerability reviews, and remediation validation.

• Maintain assessment documentation, evidence repositories, compliance tracking records, and security assessment dashboards.

Required Qualifications

• Active Top Secret (TS) security clearance.

• Minimum 2 years of experience in cybersecurity, information security, RMF, security compliance, or IT security operations.

• Foundational understanding of the NIST Risk Management Framework (RMF) and its seven steps.

• Familiarity with NIST SP 800-53 security controls and NIST SP 800-53A security assessment procedures.

• Basic understanding of security assessment methodologies, control testing, risk analysis, and vulnerability management.

• Knowledge of key RMF and ATO artifacts, including SSP, SAP, SAR, POA&M, Risk Assessment Report (RAR), and authorization packages.

• Familiarity with access controls, configuration management, audit logging, system security, and vulnerability remediation.

• Strong analytical, technical documentation, and communication skills.

• Ability to work onsite in Washington, DC, five days per week.

Preferred Qualifications

• CompTIA Security+, CAP/CGRC, or equivalent cybersecurity certification.

• Exposure to federal security assessment and authorization activities.

• Familiarity with eMASS, CSAM, Xacta, or similar GRC platforms.

• Experience reviewing vulnerability scanning results and cybersecurity compliance evidence.

• Understanding of FISMA, FedRAMP, NIST SP 800-30, and continuous monitoring requirements.

• Basic knowledge of Windows, Linux, cloud security, network configurations, and identity and access management.

Posted October 15, 2026

Senior Platform Engineer

Active Top Secret (TS) Required

Position Overview

Delviom is seeking an experienced Senior Platform Engineer to support a federal program focused on modernizing enterprise data infrastructure, cloud platforms, application services, and secure mission-critical systems.The Senior Platform Engineer will be responsible for designing, implementing, automating, securing, and maintaining scalable cloud infrastructure and application hosting environments. This role will focus heavily on AWS cloud services, Infrastructure as Code (IaC), Kubernetes, container orchestration, CI/CD pipelines, platform automation, observability, and DevSecOps practices to support enterprise data pipelines, applications, APIs, analytics platforms, and AI-enabled workloads. The engineer will collaborate closely with Cloud/Data Engineers, Application Developers, Data Architects, Cybersecurity Engineers, and DevSecOps teams to deliver reliable, secure, and highly available infrastructure supporting mission operations.

Required Skills & Qualifications

• Bachelor's degree in Computer Science, Information Technology, Engineering, or a related technical discipline, or equivalent professional experience.
• Minimum 8 years of experience in platform engineering, cloud infrastructure, systems engineering, DevOps, or DevSecOps.
• Strong hands-on experience with AWS cloud infrastructure, including EC2, VPC, IAM, S3, EKS, CloudWatch, RDS, and networking services.
• Demonstrated experience implementing Infrastructure as Code using Terraform or CloudFormation.
• Strong experience with Docker, Kubernetes, container orchestration, and microservices deployment.
• Experience developing and managing CI/CD pipelines using Jenkins, GitLab CI/CD, GitHub Actions, or similar platforms.
• Strong knowledge of Linux system administration, cloud networking, infrastructure troubleshooting, and performance optimization.
• Proficiency in Python, Bash, or PowerShell for automation and scripting.
• Experience with monitoring and observability tools such as Grafana, Prometheus, CloudWatch, ELK, or OpenSearch.
• Experience implementing cloud security, IAM, encryption, secrets management, vulnerability scanning, and DevSecOps controls.
• Familiarity with enterprise data platforms, cloud databases, ETL/ELT infrastructure, APIs, and distributed applications.
• Understanding of NIST SP 800-53, RMF, Zero Trust, and federal cloud security practices.

Posted October 15, 2026

Senior Vulnerability Assessment Lead

Active Top Secret (TS) Required

e are seeking an experienced Senior Vulnerability Assessment Lead to oversee enterprise-wide cybersecurity risk assessments, vulnerability management, security configuration assessments, and remediation activities for a federal government program.

The ideal candidate will possess strong technical expertise in identifying, analyzing, prioritizing, and mitigating security vulnerabilities across federal information systems, networks, applications, cloud environments, and High Value Assets (HVAs). This role requires hands-on experience with enterprise vulnerability assessment tools, NIST security frameworks, security control assessments, risk analysis, and federal cybersecurity compliance requirements.

The Senior Vulnerability Assessment Lead will manage vulnerability assessment operations, evaluate technical security risks, coordinate remediation efforts, validate corrective actions, maintain POA&Ms, develop Risk Assessment Reports (RARs), and provide actionable recommendations to improve the organization's overall security posture.

Key Responsibilities

• Lead enterprise Risk and Vulnerability Assessments (RVAs) across networks, servers, endpoints, applications, cloud infrastructure, databases, and High Value Assets.

• Plan, execute, and oversee vulnerability scanning, technical security assessments, configuration compliance reviews, and security posture evaluations.

• Manage and optimize vulnerability assessment platforms, including Tenable Nessus, Tenable Security Center, Qualys, Rapid7, and comparable tools.

• Analyze CVEs, CVSS scores, CISA Known Exploited Vulnerabilities (KEV), exploitability, threat intelligence, and business impact to determine vulnerability severity and remediation priorities.

• Evaluate system security configurations, hardening requirements, security baselines, and control effectiveness using NIST SP 800-53, NIST SP 800-53A, and NIST SP 800-115.

• Conduct risk assessments, identify security weaknesses, assess likelihood and impact, and recommend risk mitigation strategies.

• Coordinate with system owners, ISSOs, security engineers, infrastructure teams, and application owners to track vulnerability remediation and corrective actions.

• Develop and maintain POA&Ms, vulnerability tracking reports, remediation roadmaps, risk registers, and security assessment documentation.

• Validate remediation effectiveness through rescanning, configuration verification, technical testing, and supporting evidence reviews.

• Support risk acceptance reviews, residual risk analysis, compensating control evaluations, and escalation of unresolved critical vulnerabilities.

• Prepare Risk Assessment Reports (RARs), executive risk briefings, vulnerability trend analyses, operational dashboards, and remediation performance metrics.

• Support continuous monitoring, ATO activities, federal security audits, and compliance reporting requirements under FISMA and FedRAMP, as applicable.

• Identify recurring vulnerabilities, systemic security weaknesses, and remediation gaps, and recommend preventive and corrective security improvements.

Required Qualifications

• Minimum 10 years of progressive cybersecurity experience, including extensive experience in vulnerability management, technical security assessments, and enterprise risk analysis.

• Proven experience leading Risk and Vulnerability Assessments (RVAs) across complex enterprise or federal IT environments.

• Advanced hands-on experience with Tenable Nessus, Tenable Security Center, Qualys, Rapid7, or comparable vulnerability management platforms.

• Strong knowledge of vulnerability identification, scanning methodologies, security configuration assessments, risk prioritization, and remediation validation.

• Expertise in analyzing CVEs, CVSS, CISA KEV, threat intelligence, exploitability, and business risk.

• Strong understanding of NIST SP 800-53, NIST SP 800-53A, NIST SP 800-115, FISMA, and FedRAMP requirements.

• Experience conducting assessments across Windows, Linux, network infrastructure, cloud environments, and enterprise applications.

• Experience developing and maintaining POA&Ms, RARs, risk registers, technical assessment findings, and executive security reports.

• Ability to coordinate enterprise remediation programs, validate corrective actions, and communicate technical risks to leadership.

• Strong technical leadership, analytical thinking, documentation, and stakeholder communication skills.

Preferred Qualifications

• Certifications such as CISSP, CISM, CGRC, CRISC, CEH, or GIAC certifications.

• Experience supporting federal civilian agencies and government cybersecurity programs.

• Familiarity with NIST SP 800-30, NIST RMF, CISA Binding Operational Directives, and federal continuous monitoring programs.

• Experience assessing High Value Assets (HVAs), hybrid cloud environments, AWS, Azure, and enterprise network infrastructure.

• Knowledge of DISA STIGs, CIS Benchmarks, SCAP, and security configuration compliance.

• Experience developing automated vulnerability management dashboards using Power BI, Splunk, or similar reporting platforms.

Posted October 15, 2026

Cybersecurity Solutions Architect

10+ years of experience preferred

Design cybersecurity service solutions, support proposal and solution-development efforts, align technical approaches with applicable security frameworks, and help advance Delviom's AI-enabled cybersecurity capabilities.

Posted August 6, 2026