ARETUM

Compliance

• Support governance and compliance activities aligned to FISMA and agency cybersecurity requirements, including maintaining documentation and reporting support where applicable
• Execute RMF-aligned risk activities across the system lifecycle, including control selection support, implementation validation, and ongoing continuous monitoring
• Maintain and update authorization/compliance artifacts (as required by the environment), such as security plans and supporting evidence, ensuring documentation is accurate and audit-ready
• Assist with security control assessment coordination by preparing artifacts, mapping evidence to controls, tracking assessment activities, and supporting remediation planning (Assessment methods and procedures are commonly aligned to NIST 800-53A practices)
• Develop, manage, and track POA&Ms and remediation actions; collect and validate closure evidence and support risk acceptance processes as needed
• Demonstrate and apply working knowledge of network design concepts and partner with technical teams to validate secure configurations and identify weaknesses
• Support vulnerability management and security testing coordination for government systems to identify and document vulnerabilities, validate severity/impact, and track mitigation to completion
• Support project management activities including work planning, task tracking, stakeholder coordination, meeting facilitation, and status reporting for GRC deliverables
• Contribute to policy/standard development and continuous improvement initiatives for governance and risk processes using NIST-aligned control frameworks

Governance, Risk, and Compliance Specialist – Contingent

Security Engineer

• Lead end-to-end delivery of cybersecurity assessments/audits of government systems, including assessment planning, evidence collection, technical testing, analysis, and reporting
• Develop and execute Security Assessment Plans (SAP) and ensure assessment procedures align to required control assessment methodologies
• Conduct and oversee technical testing activities (e.g., vulnerability scanning, penetration testing, configuration validation, and other security examinations) and translate results into clear, actionable findings
• Evaluate the effectiveness of security controls (including inherited/common controls where applicable) and document whether controls meet intent and requirements
• Produce high-quality deliverables (e.g., Security Assessment Reports/SARs, risk narratives, remediation recommendations) and support POA&M development and closure evidence
• Provide technical leadership to assessors (tasking, mentorship, peer review, quality assurance, and consistency of methodology across engagements)
• Partner with project leadership to manage scope, schedules, dependencies, and risks; communicate project status and constraints to stakeholders
• Brief technical and non-technical stakeholders on risk, severity and prioritized remediations, and advise on practical mitigation strategies
• Maintain professionalism and independence expected of assessment personnel and ensure assessments are defensible and audit-ready

Lead Cybersecurity Assessor, Technical Lead

Full-stack Engineer

• - Actively participate in the analysis, design, and development of various modernization efforts.
• - Assist with all aspects of the Agile development: gather requirements, lead/participate in standup meetings, write user stories, create tasks, develop code, review backlogs, and work on assigned tasks.
• - Assist developers and lead development efforts with building, maintaining, and enhancing websites and web applications using .NET (C#), Postgres, GraphQL and optionally the MEAN stack.
• - Contribute to CI/CD pipeline development and deployment processes.
• - Support containerization strategies and troubleshoot deployment issues.
• - Plan and implement unit testing into the code and development life cycle.
• - Assist/Review load tests to identify bottlenecks and latency issues.
• - Make recommendations to implement optimizations, enhancements, and fixes.
• - Provide guidance and collaborate closely with a small development team.
• - Review and troubleshoot bugs and identify problem resolutions.
• - Assist and provide guidance to promote various best practices into the software development lifecycle.

Senior Software Engineer

• Available full time to work as part of the existing IPT to build the new Partner API solution.
• This resource will participate in all aspects of the task but will be focused day to day on delivering the Partner API MVP.
• Work alongside other engineers and contractors and be expected to participate in all agile ceremonies (e.g. sprint planning, code reviews, retrospectives and backlog grooming).
• Design and develop patterns, processes and best practices for GraphQL development based on the choices made for the Partner API.
• These patterns, practices and processes will be demonstrated in the Partner API solution and will additionally be documented, and training will be conducted as needed to ensure the entire IPT is able to use these patterns and practices in the future.