Information System Security Officer (ISSO)

MUST BE US CITIZEN WITH ACTIVE SECRET CLEARANCE OR HIGHER

NO VENDOR ASSISTANCE AT THIS TIME

Information System Security Officer (ISSO)

Onsite in Arlington, VA

Clearance

Secret (or higher)

We are seeking an Information System Security Officer (ISSO) to support the GSS 2.0 program. You will safeguard information systems assets and maintain security compliance across the organization, working with both IT teams and management. The successful candidate brings a strong foundation in Assessment and Authorization (A&A) activities and a solid working knowledge of the Risk Management Framework (RMF) and NIST cybersecurity publications.

Responsibilities

• Develop and coordinate all authorization documentation, including the System Categorization, System Security Plan (SSP), and System Risk Assessment
• Support the control assessment, reporting, and continuous monitoring processes
• Coordinate with the DoS liaison to provide POA&M status
• Support and document Security Control Assessments, assist in remediation, and ensure POA&Ms are appropriately managed
• Update the Business Continuity and Contingency Plan for the component
• Conduct vulnerability scanning of IT systems and provide reports and metrics
• Assist components with decisions that affect the security of their systems and networks
• Assess information systems security requirements, evaluate current security posture, and recommend priorities for remediation
• Review information system infrastructure and application architecture to assess security requirements
• Review existing SA&A documentation, Security Assessment Reports, and security infrastructure (e.g., IDS, firewalls, vulnerability scan tools)
• Assess NIST SP 800-53 Rev 4/Rev 5 controls and document results
• Evaluate and strengthen SA&A documentation and work with the customer to maintain the system ATO
• Perform and document risk assessments, analyzing security vulnerabilities and the metrics used to measure associated risk
• Conduct annual NIST-based self-assessments, identify weaknesses, and develop a POA&M for each based on industry best practices
• Monitor and analyze Intrusion Detection Systems (IDS) to identify security issues for remediation
• Recognize potential, successful, and unsuccessful intrusion attempts and compromises through thorough review and analysis of event detail and summary information
• Evaluate technology change requests and assess organizational risk
• Assist with implementation of countermeasures or mitigating controls
• Research, evaluate, test, and implement new security software or devices
• Conduct investigations of information systems security violations and incidents, reporting to management as necessary
• Implement, enforce, communicate, and develop security policies or plans for data, software applications, hardware, telecommunications, and information systems security education/awareness programs
• Perform periodic and on-demand system audits and vulnerability assessments, including user accounts, application access, file system, and external web integrity scans to determine compliance
• Provide information to management regarding the negative impact on the business caused by theft, destruction, alteration, or denial of access to information
• Ensure compliance with regulations and privacy laws
• Develop materials for computer security education/awareness programs
• Respond to queries and requests for computer security information and reports
• May serve as a team or task lead

Requirements

• Bachelor's degree (BA/BS) or equivalent
• Must be a U.S. Citizen
• Must possess Secret security clearance (or higher)
• Minimum 5 years of IT Security experience
• Strong working knowledge of NIST Special Publications, including NIST SP 800-37 and 800-53
• Experience with AWS (preferred)
• Clear written and oral communication skills
• Ability to troubleshoot and solve complex technical problems

Required Certifications

Current certification in one or more of the following:

• ISACA – Certified Information Systems Auditor (CISA)
• ISACA – Certified Information Security Manager (CISM)
• (ISC)² – Certified Information Systems Security Professional (CISSP)
• (ISC)² – Certified Authorization Professional (CAP)