ISSO

Applicants selected will be subject to a government security investigation and must meet eligibility requirements for access to classified information. Top Secret clearance is required w/ the ability to get SCI.

Provides security engineering design, implementation and test support in all aspects of Information Assurance and Information Security (InfoSec) Engineering at all stages of the Systems Development Life Cycle (SDLC) process.

Assesses and mitigates system security threats/risks throughout the program life cycle; determines/analyzes and decomposes security requirements at the level of detail that can be implemented and tested; reviews and monitors security designs in hardware, software, data, and procedures; performs system certification and accreditation planning and testing and liaison activities; supports secure systems operations and maintenance.

Perform security engineering analysis, risk and vulnerability assessment, etc. Monitor and analyze security functional tests. Prepare C&A documentation such as SSP, SCONOPS, ST&E reports, etc.

Requirements:

Bachelors degree is preferred, CISSP required.
5 years of experience is a minimum.
FISMA experience
NIST experience
C&A experience required (able to C&A systems – servers, computers, etc…)
Network experience
Proven ISSO experience
Risk assessment experience, especially with NIST 800-30 Threat identification, system security categorization, gap analysis, compliance reporting
Security analysis experience, especially trend analysis, incident response, encryption
Security assessment experience doing vulnerability scanning, penetration testing, system hardening, system integration, packet sniffing
Software development experience a plus given the unit supporting
Must be able to apply and validate patches
Develop, track, create and manage POA&Ms
Able to handle site accreditation
Operational security experience a definite plus
Security plan knowledge and creation experience a definite plus
Knowledge of and experience with quality assurance and continuous monitoring
Able to work in SCIF