Risk Assurance SME

The Leidos Partnership for Defense Health is seeking skilled and adaptable Risk Assurance SME to work remotely in support of its single-award DHMSM IDIQ contract for the system known as MHS GENESIS. This highly visible program modernized Electronic Health Record capabilities for the Department of War, supporting nearly 10 million service members and their families worldwide. While healthcare systems everywhere are challenged to improve quality, user experience, and cost, MHS GENESIS operates at DoW global scale and within a highly secure environment, all while supporting the Defense Health Agency’s vision of a medically ready force—critical to our national defense.

The Risk Assurance SME will support the effort of ensuring successful implementation of a comprehensive and sustainable cyber security risk assurance program based on a defined strategy. They will accomplish this thru supporting the Cyber Assurance Lead in identification and implementation of risk assurance and RMF processes across multiple different delivery methods and engineering teams.

Responsibilities

• Engage with engineering stakeholders to explain DHA risk assessment processes and ensure high-quality risk assessment packages for review and approval for submission to the DHMSM ISSOs and DHA RMED (Defense Health Agency, Risk Management Executive Division) for review and approval.

• Coordinate and review risk assessment artifacts (POAMs, STIG/SRG Checklists, False Finding artifacts), providing feedback to engineering teams.

• Track and support risk assessments in collaboration with the Cyber Assurance Lead.

• Lead internal and external project meetings, providing updates on progress and milestones.

• Support the development and maintenance of the Integrated Master Schedule (IMS) for projects, where applicable.

• Leverage established intake processes for new risk assessments, ensuring proper coordination with engineering teams and the DHMSM Cyber team.

• Coordinate and oversee risk assessment activities involving third-party resources to ensure alignment with program objectives.

• Implement tools and solutions to automate and visualize metrics, reporting, and dashboards.

• Facilitate daily meetings with stakeholders as needed, using a scrum approach for escalated risk assessments.

• Assess and report on identified and anticipated project risks.

Qualifications

• US Citizen with current U.S. Government Secret clearance (contract requirement).

• Bachelor’s degree and 4–8 years of relevant experience.

• DoD 8570 IAM Level 1 or IAT Level 2 certification, or ability to obtain within 6 months of hire.

• Excellent written and verbal communication skills.

• Strong critical thinking and analytical skills.

• Ability to organize and prioritize multiple requests in a fast-paced, deadline-driven environment.

• Proficiency in Microsoft Office tools and project management tools such as JIRA.

• Experience identifying applicable STIG checklists based on assessed technologies, conducting STIG compliance reviews, and analyzing Check Text and Fix Text to validate security control implementation and remediation requirements.

• Ability to review POA&M data for accuracy and appropriateness, ensuring findings, remediation details, and statuses are correctly documented.

Preferred Qualifications

• Knowledge of MHS GENESIS system and capabilities.

• Experience with risk assessments in cloud environments (Oracle Cloud Infrastructure, Azure).

• Familiarity with DoW/DHA cybersecurity policies and IA security principles.

• Experience with DHMSM risk coordination and implementation practices.

• Knowledge of networks, cyber defense toolsets, and related technologies.

• Experience with Dow Information Assurance Vulnerability Management (IAVM) Program.

• Proficiency in ACAS/NESSUS, SCAP, HBSS.

• Experience with eMASS (Enterprise Mission Assurance Support Service).

• Experience implementing DHA RMF Process and NIST 800-53 technical controls, including achieving and maintaining Authorization to Operate (ATO).

If you're looking for comfort, keep scrolling. At Leidos, we outthink, outbuild, and outpace the status quo — because the mission demands it. We're not hiring followers. We're recruiting the ones who disrupt, provoke, and refuse to fail. Step 10 is ancient history. We're already at step 30 — and moving faster than anyone else dares.

The Leidos pay range for this job level is a general guideline only and not a guarantee of compensation or salary. Additional factors considered in extending an offer include (but are not limited to) responsibilities of the job, education, experience, knowledge, skills, and abilities, as well as internal equity, alignment with market data, applicable bargaining agreement (if any), or other law.