Information System Security Officer

Job Profile Summary

Performs all procedures necessary to ensure the safety of information systems assets and to protect systems from intentional or inadvertent access or destruction. Monitor, evaluate, and maintain systems and procedures to safeguard internal information systems, network, databases, and Web-based security. A successful candidate will have a strong foundation in Certification and Authorization activities, along with a good working knowledge of the Risk Management Framework (RMF) and NIST publications related to cybersecurity. They will work with both the IT teams and management to maintain security compliance throughout the organization.



Responsibilities

Develop and coordinate all authorization documentation associated including the Systems Categorization, Systems Security Plan, and Systems risk assessment
Support the control assessment, reporting and monitoring processes
Coordinate DoS liaison to provide POA&M status
Support and document Security Control Assessments, assist in remediation and ensure that POA&Ms are being appropriately managed.
Update Business Continuity and Contingency Plan for the component.
Conduct vulnerability scanning of IT systems and provide reports and metrics
Assist the components with decisions that affect security of their systems and networks.
Conduct assessments of information systems security requirements, evaluate current security posture and recommend priorities for remediation.
Review information system infrastructure and application architecture to assess security requirements
Review existing SA&A documentation, Security Assessment Report and security infrastructure (i.e. IDS, firewalls, vulnerability scan tools, etc.)
Assess NIST 800-53, Rev 4/Rev 5 Control and document results
Evaluate and strengthen standard SA&A Documentation, work with the customer to maintain the system ATO
Perform and document risk assessments, analyzing security vulnerabilities, and the metrics to measure the risks associated with those vulnerabilities;
Review and conduct annual NIST-based Self Assessments, identifying any weaknesses which need to be addressed, and developing a POA&M for each of those weaknesses based on industry best practices.
Monitors and analyzes Intrusion Detection Systems (IDS) to identify security issues for remediation
Recognizes potential, successful, and unsuccessful intrusion attempts and compromises thorough reviews and analyses of relevant event detail and summary information
Evaluates technology change requests and assesses organizational risk
Assists with implementation of countermeasures or mitigating controls
Researches, evaluates, tests, and implements new security software or devices
Conducts investigations of information systems security violations and incidents, reporting as necessary to management
Implements, enforces, communicates, and develops security policies or plans for data, software applications, hardware, telecommunications, and information systems security education/awareness programs
Performs periodic and on-demand system audits and vulnerability assessments, including user accounts, application access, file system and external Web integrity scans to determine compliance
Provides information to management regarding the negative impact on the business caused by theft, destruction, alteration, or denial of access to information
Ensure compliance with regulations and privacy laws
Develops materials for computer security education/awareness programs
Responds to queries and requests for computer security information and reports
May serve as a team or task lead


Education: BA/BS or equivalent from an accredited university is required.



Must one more of the following certifications:

ISACA - Certified Information Systems Auditor (CISA)
ISACA - Certified Information Security Manager (CISM)
(ISC)2 - Certified Information Systems Security Professional (CISSP)
(ISC)2 - Certified Authorization Professional (CAP)
Required Skills
Education: BA/BS or equivalent from an accredited university is required.



Must one more of the following certifications:

ISACA - Certified Information Systems Auditor (CISA)
ISACA - Certified Information Security Manager (CISM)
(ISC)2 - Certified Information Systems Security Professional (CISSP)
(ISC)2 - Certified Authorization Professional (CAP)


Required Skills/Knowledge/Experience:

5 years of IT Security experience
Strong working knowledge with NIST Special Publications and the NIST SP 800-37, 800-53,
Clear written and oral communication skills.
Ability to troubleshoot and solve complex technical problems.
Experience with AWS is preferred
Additional Details
Work Location: 100% Remote from within the continental United States of America



Security Requirements

Must be a US Citizen
Able to obtain and maintain a SECRET security clearance