Job Posting for Cross Functional ISSO SME at Solutions By Design II
Description/Job Summary
The Cross Functional Information System Security Officer (ISSO) SME supports all Risk Management Framework (RMF) activities including the process managing security and privacy risk, including information system categorization; control selection, implementation, and assessment; system and common control authorizations; and continuous monitoring. This person also supports the security activities associated with evaluating, implementing, managing security practices and continued operations of new and existing technologies across the Enterprise. This person will provide oversight into all IASS responsibilities as required and will support both but Unclassified (SBU) and For Official Use Only (FOUO) systems. The Contractor shall perform all duties and responsibilities in accordance with DHS 4300A, DHS ISSO Guide, and other applicable guidance.
Responsibilities Include:
Risk Management Framework (RMF) Activities:
Support all activities as outlined in the NIST SP 800-37, Risk Management Framework for Information Systems and Organizations. This includes the process for managing security and privacy risk that includes information security categorization; control selection, implementation, and assessment; system and common control authorizations; and continuous monitoring.
Security Authorization Documentation:
Initial development and, at least, annual reviews/updates of the FIPS 199, e-Authentication, Privacy Threshold Analysis (PTA)/Privacy Impact Analysis (PIA), Security Plan (SP), Contingency Plan (CP), and Contingency Plan Test (CPT), Interconnection Security Agreement (ISAs) and Memorandum of Agreement/Understanding (MOA/Us) and any other FISMA related security documentation.
Security Control Assessment Response:
Support all assessment activities by responding to interview questions as well as working with the system teams to gather appropriate evidence as directed by the SCA team.
Change Management:
Review all change requests for potential impact to the system security posture.
Continuous Monitoring:
Conduct audit log and account management reviews and update the Control Allocation Table and Trigger Accountability Log.
Configuration/Patch/Vulnerability Management:
Review scan results for the system assets, identify the respective remediation's for misconfigurations and weaknesses, and work with the system team to ensure timely implementation of fix.
Incident Response:
Work with the Security Operations Center (SOC) and system teams to investigate and analyze any incidents affecting assigned system(s).
Additional Responsibilities:
Apply a comprehensive knowledge across key tasks and high impact assignments
Evaluate performance results and recommend major changes affecting short-term project growth and success
Function as a technical expert across multiple project assignments
Work on high priority ad-hoc request such as data calls, Senior Management Initiatives (CIO, CISO, etc.), customer mandates, etc.
Have a deep understanding of Security Regulations, such as the NIST Publications and OMB Security related documents
Prepare documentation and materials to support the operations of FedRAMP compliance requirements throughout the organization
Develop briefings and presentations for Government PM and Executive Management
Be able to adapt to an Agile environment and provide quality, professional deliverables in a short timeframe with little to no guidance from the Government
Support all Security Authorization Processes, Security Control Assessments and Ongoing Authorization activities as required and as directed by the Federal Government
Ensure systems are properly patched and hardened according to DHS requirements
Assist with issues and concerns related to their assigned systems
Perform other duties as assigned by the Government
Conduct research and analysis on abnormalities and provide recommendations
Conduct Risk Analysis on vendors, cloud service providers, etc. as necessary to identify flaws, threats and risks in emerging IT projects, and develop technical in-depth engineering solutions to address and mitigate these risks
Provide technical security solutions and control implementation recommendations to the Agile Development teams based on industry best practice and Federal requirements
Provide, prepare, and conduct security training, as needed
Apply and analyze privacy laws, administrative laws, regulations and policies surrounding the Privacy Act of 1974, the E-Government Act of 2002, or the Homeland Security Act of 2002
Serving as a subject matter expert on controls standards such as NIST 800-53, 800-37, 800-66, and 800-171 as well as other privacy regulations
Work on the automation, monitoring and auditing of privacy controls for each system
Support security and privacy requirements for internal and external system connections
Support proposed collection, sharing, and maintenance of PII through privacy compliance documentation
Perform comprehensive document reviews (DR) on all risk management and security operations documentation, in alignment with DHS, USCIS and FISMA requirements
Conduct quality assurance checks to ensure that the finished documentation meets DHS, USCIS, and FISMA requirements
Implement a two (2) day turn around for the following artifacts: FIPS 199, E-Authentication Workbook, PTA, PIA, CP, CPT and a five (5) day turn around for the review of the Security Plan (SP).
Establish a mailbox and report tracking mechanism to ensure that the federal staff knows the status of all documents that are in the review process at all times by running a simple report.
Revise, edit, or update security authorization documentation and presentations
Create, adapt, and follow project schedules and deadlines
Develop a thorough understanding of the audience and the documentation required by meeting with colleagues, and working with managers to discuss technical problems
Research and build knowledge about products, services, technology, or concepts
Determine the clearest and most logical way to present information and instructions for greatest reader comprehension, and write and edit technical information accordingly
Prepare or commission graphics and illustrations to elaborate on or complement technical writing
Meet with SMEs in order to ensure that specialized topics are appropriately addressed and discussed
Perform other duties as assigned by the Government
Required Qualifications
Requirements:
Must be a US Citizen able to obtain a federal clearance
Must be located in the Washington, DC metro area and be able to commute to the customer site in Washington, DC as needed (some remote work is acceptable)
Must have and maintain at least one active certification such as CASP, GSEC, GSLC, CISSP, CEH, CISM, and CISA, or other comparable certification which must be approved in advance by the Government PM (on a case-by-case basis)
5+ years of experience managing IT projects and programs or specialized experience in one of the below positions: Information Systems Security Officer, Information Systems Security Engineer, Information Systems Security Auditor or Information Systems Security Manager
5+ years of experience with analyzing, assessing and implementing corrective actions based on vulnerability management tools
5+ years of experience with leading projects, technical writing, administrative tasks, and conducting briefings
5+ years of experience in security engineering or security operations
Experience in security process mapping, security process analysis, security process improvement concepts, models, and best practices
Excellent customer service, analytical, problem solving, team-building, and interpersonal skills
Ability to work independently and function as an integral part of the team
Excellent oral and written communication skills; technical and business focused, with the ability to document and describe security process information collected
Listening skills, the ability to detect explicit and implicit needs and wants
Demonstrated ability to exercise good judgment, prioritize multiple tasks, and problem solve under pressure of deadlines and resource constraints
Proven experience in building consensus and managing cross-functional teams
Demonstrated proficiency in vast array of Cyber Security platforms: Standard Application Online (SAO), Security Information and Event Management (SIEM), Intrusion Detection System (IDS)/Intrusion Protection System (IPS), Data Loss Prevention (DLP), Web Application Firewalls (WAF), Threat Intel, Endpoint Security
Advanced Microsoft Excel and Access skills to perform extensive data mining, correlation, and reporting
Experience working with NIST SP 800-53, RMF, FISMA, DHS and DoD policies
Listening skills, the ability to detect explicit and implicit needs and wants
Demonstrated ability to exercise good judgment, prioritize multiple tasks, and problem solve under pressure of deadlines and resource constraints
Ability to work independently and function as an integral part of the team
Strong analytical and problem-solving skills
Demonstrated interviewing and negotiation skills applicable to identifying, defining, and evaluating requirements
Salary.com Estimation for Cross Functional ISSO SME in Washington, DC
$90,164 to $113,877
If your compensation planning software is too rigid to deploy winning incentive strategies, it’s time to find an adaptable solution.
Compensation Planning
Enhance your organization's compensation strategy with salary data sets that HR and team managers can use to pay your staff right.
Surveys & Data Sets
Sign up to receive alerts about other jobs with skills like those required for the Cross Functional ISSO SME.
Click the checkbox next to the jobs that you are interested in.