NLM Security Specialist I - III

Job Description

Job Description:\n\nSecurity Specialist I – III\n\nLexical Intelligence provides software and services related to processing large-scale biomedical information sources. Our Natural Language Processing (NLP) and analytics software is used by policy and decision makers to evaluate and prioritize current and emerging areas of research.\n\nWe are looking for Security Specialists (I – III) to work within the National Library of Medicine (NLM), Lister Hill National Center for Biomedical Communications (LHNCBC), located at Building 38A on the NIH campus in Bethesda, MD. The Security Specialists will have experience in federal information security and compliance, vulnerability assessment and risk management, and cloud and application security operations. The Security Specialists will have a firm understanding of FISMA requirements, NIST security standards, HHS/NIH cybersecurity policies, and federal information security governance frameworks. The Security Specialists shall be able to work well within a team of multidisciplinary IT professionals including DevOps engineers, software developers, data scientists, and clinical informatics specialists. The selected applicants will be subject to a pre-employment background and reference check.\n\nLevel Descriptions\n\nSecurity Specialist I – Entry to mid-level professional with foundational experience in federal information security and compliance. Works under supervision, executing defined security tasks, supporting vulnerability assessments, and contributing to compliance documentation and incident response activities. Focuses primarily on operational security support, training compliance, and assisting with ATO documentation and security scanning activities.\n\nSecurity Specialist II – Mid to senior-level professional with demonstrated experience leading security activities across complex federal IT programs. Works with greater independence, managing vulnerability programs, overseeing ATO lifecycle activities, and providing technical security guidance to development and operations teams. Contributes to cloud security governance, incident response leadership, and privacy compliance programs.\n\nSecurity Specialist III – Senior-level professional serving as the strategic security leader for enterprise cybersecurity programs. Provides expert guidance on security architecture, governance, and risk management across multi-team, multi-system environments. Leads enterprise ATO programs, directs incident response and breach management, and serves as the primary security liaison to senior government officials and federal security stakeholders.\n\nRequired Qualifications\nSecurity Specialist I\n\n4 years of relevant information security or cybersecurity experience\nBachelor's degree or other degree(s) in Computer Science, Information Security, Information Technology, or related fields\nKnowledge and practice of the Federal Information Security Modernization Act (FISMA) and related compliance frameworks\nExperience with NIST Special Publications including SP 800-53, SP 800-171, SP 800-88, and SP 800-64\nExperience supporting or maintaining Authority to Operate (ATO) documentation and System Security Plans (SSPs)\nFamiliarity with vulnerability scanning and management tools such as Tenable Security Center, Nessus, or Prowler\nAbility to identify, document, and track security vulnerabilities and support remediation within prescribed timelines\nStrong written and oral communication skills, including the ability to convey technical security concepts in plain language\n\nSecurity Specialist II\n\n6 years of progressive information security or cybersecurity experience in a federal or government contracting environment\nBachelor's degree or other degree(s) in Computer Science, Information Security, Information Technology, Cybersecurity, or related fields; advanced degree preferred\nDemonstrated expertise in FISMA compliance, including full lifecycle management of ATO documentation and SSP development and maintenance\nAdvanced knowledge of NIST Special Publications including SP 800-53, SP 800-64, SP 800-88, SP 800-171, and FIPS 199/200 security categorization standards\nProven experience conducting vulnerability assessments, threat identification, and penetration testing using tools such as Tenable Security Center, Prowler, Netsparker, Checkmarx, and/or OWASP-based tools\nExperience managing and responding to cybersecurity incidents in accordance with federal incident response policies, including reporting to CSIRC/NIH IRT within required timelines\nExperience administering and securing cloud environments across multiple platforms including AWS, Google Cloud (GC), and/or Microsoft Azure, including Identity and Access Management (IAM)\nStrong written and oral communication skills with demonstrated ability to brief senior leadership and government officials on security posture, risk, and remediation strategies\n\n Security Specialist III\n\n8+ years of progressive, senior-level information security or cybersecurity experience, with a significant portion in a federal government or government contracting environment\nBachelor's degree or other degree(s) in Computer Science, Information Security, Cybersecurity, Information Technology, or related fields; Master's degree strongly preferred\nExpert-level knowledge and demonstrated leadership in FISMA compliance, including strategic oversight of ATO lifecycle management, SSP development, and continuous monitoring programs across enterprise-level federal information systems\nExpert knowledge of NIST Special Publications including SP 800-53, SP 800-64, SP 800-88, SP 800-171, and FIPS 199/200, with demonstrated ability to apply these frameworks to complex, multi-system environments\nDemonstrated experience leading enterprise vulnerability management programs, including the design and oversight of vulnerability assessment methodologies, penetration testing programs, and threat identification strategies\nProven leadership in cybersecurity incident response at the enterprise level, including coordination with federal agencies such as the NIH CSIRC IRT, US-CERT, and HHS OCIO\nSenior-level experience architecting and securing enterprise multi-cloud environments across AWS, GC, and Microsoft Azure, including advanced IAM strategy, cloud security posture management, and FedRAMP compliance oversight\nDemonstrated ability to brief and advise senior government officials, CORs, Contracting Officers, ISSOs, and CISOs on enterprise security posture, risk, and strategic remediation approaches\nProven experience leading and mentoring teams of security professionals and coordinating cross-functional security activities across large, complex IT programs\n\n Preferred Qualifications\n\nExperience with application security scanning tools such as Netsparker, Checkmarx, or OWASP-based tools\nFamiliarity with security assessment tools and penetration testing methodologies\nExperience supporting cloud security operations across AWS, GC, and/or Microsoft Azure environments, including IAM administration and cloud resource monitoring\nKnowledge of container security and orchestration platforms such as Kubernetes, Docker, OpenShift, or Anthos\nExperience with CI/CD pipeline security integration using tools such as GitLab, GitHub Actions, Nexus, or equivalent platforms\nFamiliarity with Infrastructure as Code (IaC) security practices using tools such as Terraform, Ansible, Puppet, or AWS CDK\nExperience with monitoring and logging tools such as EFK stack, Prometheus, Grafana, or Splunk for security event analysis\nKnowledge of HHS/NIH security policies, including HSPD-12, PIV credentialing requirements, and HHS IS2P\nExperience with Privacy Impact Assessments (PIA), Privacy Threshold Analyses (PTA), and handling of PII and PHI in compliance with the Privacy Act, HIPAA, and applicable federal regulations\nFamiliarity with FISMA-moderate environments such as FEHRDI or equivalent federal health data systems\nExperience with secure coding practices in accordance with US-CERT standards and OWASP guidelines\nFamiliarity with ticketing and documentation systems such as JIRA, ServiceNow, and Confluence\nExperience with FedRAMP requirements for cloud service providers and cloud security architecture best practices\nFamiliarity with distributed computing security, including Hadoop and related open-source frameworks\nExperience with enterprise records management and media sanitization governance in accordance with NARA policies and NIST SP 800-88\n(For Levels II and III) Experience with HHS/NIH-specific security frameworks, including the HHS Personnel Security and Suitability Program and PIV credentialing governance\n(For Levels II and III) Experience with HIPAA business associate agreement requirements and PHI governance in federal health IT environments\n(For Levels II and III) Relevant certifications such as CISSP, CISM, CISA, CEH, or equivalent federal security credentials\n(For Level III) Expert knowledge of FedRAMP, cloud service provider security governance, and strategic oversight of enterprise security training programs in accordance with HHS RBT requirements\n(For Level III) Experience providing strategic security oversight for biomedical informatics, data science, and clinical data analytics programs within federal research environments\n\n Responsibilities\n All Levels\n\nSupport or lead cybersecurity and risk management activities across NLM enterprise systems, networks, databases, and application development environments, ensuring alignment with FISMA, NIST, HHS, and NIH security policies and requirements\nAssist in or manage the lifecycle of Authority to Operate (ATO) documentation and System Security Plans (SSPs), supporting annual reviews and updates in response to evolving programmatic and security requirements\nSupport or lead the design and implementation of secure computing environments in accordance with Government FISMA policies, including firewalls, intrusion detection systems, and disaster recovery planning\nConduct or oversee vulnerability assessments and threat identification activities; document findings and support or lead remediation efforts within prescribed timelines in accordance with HHS Policy for Vulnerability Management and POAM requirements\nTrack and manage known vulnerabilities using Tenable Security Center and related security tools, ensuring resolution in alignment with HHS vulnerability management timelines\nRespond to or coordinate responses to all Alerts and Indicators of Compromise (IOCs) provided by the NIH CSIRC IRT teams within 24 hours, whether the response is positive or negative\nSupport or lead incident response activities for suspected and confirmed information security and privacy incidents and breaches, ensuring reporting to the NIH IRT within one (1) hour of discovery and coordinating all required follow-up actions in accordance with HHS, NIH, and US-CERT policies\nAssist in or oversee the protection of Controlled Unclassified Information (CUI) in accordance with Executive Order 13556, NIST SP 800-171, and applicable regulations, ensuring CUI is marked appropriately, disclosed on a need-to-know basis, and protected or destroyed in accordance with NIST SP 800-88\nEnsure all sensitive federal data and information, including PII, PHI, and proprietary information, is encrypted in transit and at rest using FIPS 140-2/140-3 validated encryption solutions\nSupport or provide security management and oversight to identify and address security vulnerabilities in both Windows and Linux systems\nAssist in or lead secure coding quality assurance activities in accordance with US-CERT standards and OWASP guidelines\nSupport or oversee the security of FISMA-moderate environments such as FEHRDI, ensuring that systems handling sensitive clinical and health-related data comply with all applicable security and privacy requirements\nAssist in or lead Privacy Impact Assessments (PIA) and Privacy Threshold Analyses (PTA) in coordination with the NIH Office of the Senior Official for Privacy, ensuring assessments are reviewed and updated at least every three years or upon major system changes or new PII collection\nSupport or oversee media sanitization activities in accordance with NIST SP 800-88 at contract closeout and as directed throughout the contract period\nComplete mandatory annual HHS/NIH Information Security Awareness, Privacy, and Records Management training prior to beginning work and annually thereafter; maintain and submit training records within required timelines\nAdhere to HHS Information Technology General Rules of Behavior and applicable Rules of Behavior for Privileged Users, obtaining and maintaining signed acknowledgments at contract initiation and annually thereafter\nComplete and maintain required Non-Disclosure Agreements (NDAs) for access to non-public government information prior to performing work under the contract\nSupport or manage the submission and maintenance of contractor staff rosters and background investigation documentation in accordance with contract timelines and requirements\nAssist in or provide technical guidance to ensure that all developed ICT solutions meet Section 508 accessibility requirements and HHS digital accessibility conformance standards\nSupport or lead the coordination of authenticated and unauthenticated vulnerability scanning activities across operating systems, networks, databases, and web applications using NIST SCAP-compliant tools\nIdentify themselves as contractor personnel in all contract-related meetings, communications, and correspondence in accordance with contract requirements\nContribute to monthly activity and financial status reports, providing security program updates to the Program Manager and COR as directed\n\n Additional Responsibilities – Security Specialist II\n\nManage the full lifecycle of ATO documentation and SSPs, ensuring annual reviews, continuous monitoring activities, and updates in response to evolving programmatic, threat, and regulatory requirements\nLead vulnerability assessment and penetration testing programs, presenting findings to senior leadership and government officials and managing enterprise-wide remediation activities\nProvide technical security guidance to development teams, advising on secure architecture design, application security reviews, and full SDLC security integration\nLead cloud security operations across AWS, GC, and Azure platforms, including advanced IAM administration, cloud security posture management, and monitoring of cloud resource efficiency and security effectiveness\nDevelop, review, and maintain Incident and Breach Response Plans (IRP) in accordance with HHS/NIH, OMB, and US-CERT requirements\nCoordinate with ISSOs, CISOs, and federal security officials on security posture, risk assessments, and compliance activities\nLead privacy governance activities, overseeing PIA and PTA processes and ensuring compliance with Privacy Act, HIPAA Rules, and applicable HHS policies\nOversee the integration of security controls within CI/CD pipelines, IaC f