IT Cybersecurity Specialist - Defense Contract Management Agency (DCMA)

The IT Cybersecurity Specialist will support cybersecurity architecture, security control implementation, Risk Management Framework documentation, ServiceNow security configuration, and continuous monitoring for the DCMA Blue List Program. This position will help ensure the Blue List platform and associated technical environments are configured, documented, and maintained in alignment with DoD cybersecurity requirements, DoD Zero Trust Strategy, NIST controls, CUI protection requirements, and DoD IL4/IL5 security expectations.

The IT Cybersecurity Specialist will work with the Government IT Program Manager, Authorizing Official, cybersecurity stakeholders, ServiceNow teams, implementation teams, sustainment teams, and other technical personnel to maintain required cybersecurity protocols, security artifacts, access controls, POA&Ms, and compliance documentation.

The ideal candidate will bring strong federal cybersecurity experience, hands-on ServiceNow security configuration experience, RMF/ATO experience, and familiarity with DoD secure cloud and identity/access management environments.

Key Responsibilities

ServiceNow Security Architecture & Controls

• Architect and implement ServiceNow-specific security controls aligned with Government cybersecurity requirements.
• Configure and maintain Role-Based Access Controls, Access Control Lists, Data Policies, and Edge Encryption.
• Support strict data segregation between IL4 public environments and IL5 CAC-authenticated environments.
• Create and maintain schema documentation and RBAC matrices outlining roles, groups, ACLs, and data segregation rules.
• Apply ServiceNow security best practices to support secure platform operations and controlled access.
• Ensure security configurations align with DoD Zero Trust principles and Blue List Program requirements.

RMF, ATO & Security Documentation

• Develop and continuously update the System Security Plan and required RMF artifacts.
• Map ServiceNow platform configurations to NIST SP 800-53, NIST SP 800-171/172, DoD IL4/IL5 controls, and CUI protection requirements.
• Support the system’s Authority to Operate process and maintain required documentation throughout the lifecycle.
• Coordinate with the Government IT Program Manager, Authorizing Official, and security stakeholders to ensure cybersecurity protocols are maintained.
• Prepare, review, and update security documentation, control mappings, evidence packages, assessment artifacts, and compliance records.
• Support security assessment and authorization activities as required.

POA&M and Vulnerability Management

• Track, manage, and update the Plan of Action and Milestones.
• Document, report, and support remediation of identified vulnerabilities within Government-provided suspense dates.
• Use ServiceNow GRC/IRM, Security Operations, or related tools when applicable to manage security findings and remediation actions.
• Monitor security risks, vulnerabilities, compliance gaps, and remediation progress.
• Coordinate with technical teams to verify corrective actions and update security documentation.
• Provide timely status updates on POA&M items and cybersecurity risk posture.

Continuous Monitoring & Compliance

• Conduct continuous monitoring activities to support ongoing ATO validity.
• Provide Security Assessment Reports documenting vulnerability scans, penetration test reviews, compliance checks, and security posture.
• Review cybersecurity evidence prior to code promotion.
• Support configuration reviews, compliance checks, vulnerability reporting, and risk analysis.
• Ensure ServiceNow configurations remain compliant with applicable federal and DoD cybersecurity directives.
• Maintain awareness of evolving security requirements, policy updates, and control expectations relevant to the Blue List Program.

Identity, Access & Data Protection

• Support integration of DoW Enterprise Identity, Credential, and Access Management / CAC authentication.
• Ensure access controls support least privilege, role-based access, and appropriate segregation of duties.
• Support secure handling of CUI, procurement-sensitive information, proprietary business information, and other sensitive program data.
• Coordinate with technical stakeholders to ensure secure data access, data segregation, authentication, and authorization processes.
• Document security roles, access groups, data policies, and control decisions.

Cyber Workforce Qualification Support

• Ensure personnel performing applicable cybersecurity, privileged access, or information assurance tasks meet DoDM 8140.03 requirements.
• Support documentation of personnel certifications and qualifications upon Government request.
• Align qualifications to appropriate Department Cyber Workforce Framework work roles and proficiency levels.
• Maintain awareness of cybersecurity workforce requirements affecting assigned project and system responsibilities.

• Bachelor’s degree in Cybersecurity, Computer Science, Computer Engineering, or a related technical discipline.
• Minimum of five years of practical cybersecurity experience.
• Active qualification aligned with DoDM 8140.03 Department Cyber Workforce Framework work roles and proficiency levels appropriate for security architecture and engineering.
• Demonstrated expertise applying federal security directives, including NIST SP 800-53 controls and NIST SP 800-161 supply chain risk management requirements.
• Demonstrated experience navigating the DoW Risk Management Framework to achieve or maintain an Authority to Operate.
• Demonstrated experience securing ServiceNow instances in FedRAMP High and DoD IL4/IL5 environments.
• Experience configuring ServiceNow Access Control Lists, Client Scripts, Data Policies, and access control structures.
• Experience integrating DoW Enterprise Identity, Credential, and Access Management / CAC authentication.
• Strong written and verbal communication skills.
• Ability to document cybersecurity findings, control implementation, risks, remediation actions, and compliance evidence clearly and professionally.