Cybersecurity Principal

Astrion•Bedford, MA

1d•Onsite

About The Position

Astrion is hiring a Cybersecurity SME at Hanscom AFB in Bedford, Massachusetts, in the C3I and Infrastructure Division (AFLCMC/HNI). The division provides enterprise support to more than 110 active Air Force, Air National Guard, and Air Force Reserve installations and bases. The role performs Information System Security Manager (ISSM) and related cybersecurity duties for assigned systems and applications, supporting implementation of the Risk Management Framework (RMF) and system assessment and authorization efforts. The position requires an active Top Secret clearance and U.S. citizenship. The role develops and maintains cybersecurity programs and policies, oversees ISSOs, advises the Authorizing Official (AO), monitors compliance and system security posture, coordinates incident response and security reviews, and maintains cybersecurity documentation and system status information. It also supports compliance with DoD and Air Force cybersecurity, certification and accreditation, public key infrastructure, software assurance, and application security requirements.

Requirements

Must have and be able to maintain an active Top Secret clearance.
Must be a U.S. citizen.
Must hold a DoDD 8140-compliant IAM Level III certification, such as Global Information Assurance Certification Security Leadership Certification, Certified Information Security Manager, and/or CISSP.
One of the following education and experience combinations is required: a master's or doctorate degree in a related field and at least 20 years of experience in the relevant technical or professional discipline, including 12 years in the DoD; a bachelor's degree in a related field and 25 years of relevant experience, including 15 years in the DoD; or 30 years of directly related experience with appropriate certifications specified in the PWS labor category performance requirements, including 20 years in the DoD.
Cybersecurity personnel must be certified in accordance with DoDD 8140 standards.
Personnel performing cybersecurity activities must obtain and maintain current technical and/or management certifications as directed by DoD 8140.02, DoD 8570.01-M, and AFMAN 17-1303.

Responsibilities

Support implementation of the Risk Management Framework (RMF).
Perform ISSM duties for assigned systems and applications as outlined in DoDI 8510.01 and DoDI 8500.01.
Develop and maintain a formal Information Systems security program and policies for the assigned area of responsibility.
Support system and application assessment and authorization efforts, assessing and guiding the quality and completeness of required activities, tasks, and artifacts.
Ensure proper measures are taken when an Information System incident or vulnerability is discovered.
Maintain and report Information System and Platform Information Technology assessment and authorization status and issues in accordance with DoD Component guidance.
Provide direction to ISSOs and ensure they are appointed in writing and follow established cybersecurity policies and procedures.
Coordinate with the organization's security manager to address issues affecting overall organizational security.
Ensure Information Owners and stewards are identified for DoD information handled by each applicable system, to establish accountability, access approvals, and special handling requirements.
Maintain a repository of organizational- or system-level cybersecurity documentation.
Monitor cybersecurity policy compliance and review monitoring results.
Coordinate cybersecurity inspections, tests, and reviews with affected parties and organizations.
Ensure implementation of system security measures and procedures, including incident reporting and coordination of responses to unauthorized disclosures.
Ensure possible or actual classified-information data spills in Information Systems are handled in accordance with DoD requirements.
Act as the primary cybersecurity technical advisor to the AO for systems under the role's purview.
Ensure cybersecurity events or configuration changes that may affect authorization or security posture are formally reported to the AO and other affected parties.
Ensure secure configuration and approval of IT products and services below the system level before acceptance into or connection to a DoD system.
Ensure ISSOs author, monitor, and record system information in applicable databases; prepare and record system, security status, and portfolio management information in EITDR.
Author, review, certify, and/or maintain information assurance and security management plans and related system or network security documents.
Perform ISSM/ISSO duties for assigned systems and applications as outlined in DoDI 8510.01.
Ensure that at least 100% of the labor provided to deliver cybersecurity services is certified in accordance with DoDD 8140 standards.
Ensure personnel performing cybersecurity activities obtain and maintain current technical and/or management certifications as directed by DoD 8140.02, DoD 8570.01-M, and AFMAN 17-1303.
Ensure system deliverables comply with DoD and Air Force cybersecurity policies, including DoDI 8500.01 and AFI 17-130.
Ensure systems comply with DoD and Air Force certification and accreditation policies, including DoDI 8510.01 and AFI 17-101.
Support activities and requirements under DoDI 8520.02 for standardized PKI-supported biometrics, digital signatures, encryption, identification, and authentication capabilities.
Ensure application deliverables comply with Public Law 111-383 software assurance requirements.
Ensure application deliverables comply with the DISA Application Security Development Security Technical Implementation Guide, including source code scanning to mitigate SQL injection, cross-site scripting, and buffer-overflow vulnerabilities.