IT Risk Assessment Auditor -Special Programs

Who are we?

MIT Lincoln Laboratory (MIT LL) is a Federally Funded Research and Development Center (FFRDC) whose mission is research in support of National Security.
* Mission - The Security Department’s (SD) overall mission is to identify and counter security threats to the MIT LL’s mission of development of game-changing technology in support of national security, including guarding against compromise by foreign intelligence agencies and insider threats.
* Culture – We foster an inclusive, opportunity-filled environment of empowered team members from diverse backgrounds.

What will you do?

Conduct independent cybersecurity compliance assessments of classified systems, networks, and supporting environments against applicable government and organizational security requirements.
* Evaluate security control implementation and effectiveness through review of system security plans, supporting documentation, technical configurations, assessment evidence, and interviews with system personnel.
* Assess compliance with applicable standards and requirements, including NIST SP 800-53, NIST SP 800-53A, JSIG, ICD 503, and DISA Security Technical Implementation Guides (STIGs).
* Perform technical and administrative reviews of system security documentation, including SSPs, security procedures, configuration management documentation, and continuous monitoring evidence.
* Evaluate technical security practices and supporting evidence related to vulnerability management, system hardening, audit logging, access control, configuration management, and other applicable cybersecurity controls.
* Identify compliance gaps, security weaknesses, and potential risks. Develop clear, objective, evidence-based findings and practical recommendations for corrective action.
* Communicate assessment results and security risks to system stakeholders, ISSMs, ISSOs, program personnel, and leadership through written reports, briefings, and assessment out-briefs.
* Coordinate with system owners and security personnel to clarify requirements, validate assessment evidence, resolve factual discrepancies, and ensure findings accurately reflect observed conditions.
* Support assessment planning, scope development, recurring compliance reviews, government inspection readiness activities, and assessments of new systems and systems undergoing authorization renewals.
* Monitor applicable changes to cybersecurity requirements, assessment guidance, and technical security standards to support consistent and current assessment practices.

How will you grow?

You will find significant opportunities to do meaningful work in an environment intentionally designed to be one where you will learn, thrive and belong.
* Leadership: Room to advance on your team or to lead cross-functional projects.
* Growth Opportunities: Potential for lateral and vertical movement.
* Education/Training: Management training, mentorship, in-house and external courses.
* Exposure: Engagement with sponsors, stakeholders, Laboratory leadership and other Departments and Divisions.
* Community: Participation is encouraged for Laboratory social events, Employee Resource Groups (ERGs), clubs and study groups, volunteering and community service projects

What you need/Requiremetns:

For this position, you must meet these basic requirements:
* Selected candidate will be subject to a pre-employment background investigation and must possess and maintain a current in scope Top Secret level DoD security clearance
* Selected candidate will be subject to a pre-employment background investigation and must be able to obtain and maintain a Top Secret level DoD security clearance with Sensitive Compartmented Information (SCI) eligibility
* Must be a U.S. Citizen.
* Successfully pass a background check and must meet all eligibility requirements for access to classified information.
* Bachelor’s degree in Computer Science, Information Technology, Computer Information Systems, or related field is preferred.
* Possess a DoD 8570.01-M IAM I baseline certification (e.g. CompTIA Security+)
* Information Assurance Certifications preferred (CISSP, CISA, CISM,).
* Additional desired certifications (CCNP – Cisco, CASP CE+, Pentest+)
* Technical experience, skills, and course work completed towards an Undergraduate Degree, or industry IT certifications may be considered in lieu of education or DoD security experience requirements
* Experience in compliance auditing, security reviews, or vulnerability assessments.
* Candidate must possess an in-depth knowledge of information security principles and policies such as Risk Management Framework (RMF) as presented by the National Institute of Standards and Technology (NIST), Joint Special Access Program (SAP) Implementation Guide (JSIG), Intelligence Community Directive 503 (ICD-503), and all applicable Security Technical Implementation Guides (STIGs).
* Experience and familiarity with multiple operating systems such as Windows Server, Windows 11, Red Hat Enterprise Linux, Ubuntu, Mac, etc.
* Experience with virtualization technologies is preferred
* Technical experience securing networks and systems utilizing DISA Security Technical Implementation Guides (STIGs) and/or SRGs is highly desired
* Excellent written and verbal communication skills are required

Ideally, you will have:

The Laboratory values experiences from diverse backgrounds and occupations. The most successful candidates will have the following skills and qualifications.
* Strong interpersonal skills and be able to manage stress in a professional manner.
* Knowledgeable in computer security principles and policies, to include the RMF, STIGs, JSIG, and ICD 503.
* Strong technical skills and ability to respond to off-hours emergencies.
* Position requires occasional local and overnight travel.