Cybersecurity Principal

Astrion•Bedford, MA

12h•Onsite

About The Position

Astrion is hiring a Cybersecurity SME to support the C3I and Infrastructure Division (AFLCMC/HNI) at Hanscom AFB in Bedford, Massachusetts. The division provides enterprise support to more than 110 active Air Force, Air National Guard, and Air Force Reserve installations and bases. The role supports Base Information Transport Infrastructure (BITI) programs and performs Information System Security Manager (ISSM) and related cybersecurity duties for assigned systems and applications. The position requires an active Top Secret clearance and U.S. citizenship. The listed annual salary range is $170,000–$200,000. The Cybersecurity SME supports implementation of the Risk Management Framework (RMF), develops and maintains cybersecurity programs and policies, guides system assessment and authorization (A&A), and advises Authorizing Officials (AOs) on cybersecurity matters. The role oversees ISSOs, monitors compliance and security posture, coordinates incident responses and inspections, and maintains system cybersecurity documentation and status information. The contractor must ensure cybersecurity personnel maintain certifications consistent with DoD requirements and that system and application deliverables comply with applicable DoD, Air Force, and DISA cybersecurity policies and standards, including requirements for PKI capabilities and software assurance.

Requirements

Must have and be able to maintain an active Top Secret clearance.
Must be a U.S. citizen.
One of the following experience and education combinations is required: a master’s or doctorate degree in a related field and at least 20 years of experience in the relevant technical or professional discipline, including 12 years in the DoD; a bachelor’s degree in a related field and 25 years of relevant experience, including 15 years in the DoD; or 30 years of directly related experience with the required certifications, including 20 years in the DoD.
DoDD 8140-compliant IAM Level III certification is required; examples include Global Information Assurance Certification, Security Leadership Certification, Certified Information Security Manager, and/or CISSP.
Cybersecurity personnel must be certified in accordance with DoDD 8140 standards.
Personnel performing cybersecurity activities must obtain and maintain current technical and/or management certifications as directed by DoD 8140.02 and outlined in DoD 8570.01-M, Appendix 3, Table 2-2, and AFMAN 17-1303.
Must ensure system deliverables comply with DoDI 8500.01 and AFI 17-130.
Must ensure compliance with DoDI 8510.01 and AFI 17-101.
Must support requirements under DoDI 8520.02 for standardized PKI-supported capabilities.
Must ensure application deliverables comply with Public Law 111-383 and the DISA Application Security Development Security Technical Implementation Guide, including source code scanning.

Responsibilities

Support implementation of the Risk Management Framework (RMF).
Perform ISSM duties for assigned systems and applications as outlined in DoDI 8510.01 and DoDI 8500.01.
Develop and maintain a formal Information Systems security program and policies for the assigned area of responsibility.
Support system and application assessment and authorization efforts by assessing and guiding the quality and completeness of required activities, tasks, and artifacts.
Ensure appropriate measures are taken when an Information System incident or vulnerability is discovered.
Maintain and report Information System and Platform Information Technology system assessment and authorization status and issues in accordance with DoD Component guidance.
Provide direction to ISSOs and oversee their compliance with established cybersecurity policies and procedures; ensure ISSOs are appointed in writing.
Coordinate with the organization's security manager to address issues affecting overall organizational security.
Ensure information owners and stewards for DoD information on applicable systems are identified to establish accountability, access approvals, and special handling requirements.
Maintain a repository of organizational or system-level cybersecurity documentation.
Monitor cybersecurity policy compliance and review monitoring results.
Coordinate cybersecurity inspections, tests, and reviews with affected parties and organizations.
Ensure implementation of Information System security measures and procedures, including incident reporting to the AO and appropriate reporting chains and coordination of responses to unauthorized disclosures.
Ensure possible or actual classified data spills in Information Systems are handled in accordance with DoD requirements.
Act as the primary cybersecurity technical advisor to the AO for systems under the role's purview.
Formally report cybersecurity events or configuration changes that may affect system authorization or security posture to the AO and other affected parties.
Ensure IT products and services below the system level are securely configured and approved before acceptance into or connection to a DoD Information System or Platform Information Technology system.
Ensure ISSOs author, monitor, and record system information in applicable databases; prepare and record system, security status, and portfolio management information in EITDR for statutory compliance.
Author, review, certify, and/or maintain IA and security management plans and related system or network security documentation, including RMF Implementation Plans, System Security Management Plans, Information Support Plans, PPPs, Security Risk Analyses, Security Vulnerability and Countermeasure Analyses, Security Concepts of Operations, and OPSEC Plans.
Perform ISSM/ISSO duties for assigned systems and applications as outlined in DoDI 8510.01.
Ensure that all labor provided for cybersecurity services is certified in accordance with DoDD 8140 standards throughout the contract period.
Ensure personnel performing cybersecurity activities obtain and maintain current technical and/or management certifications in accordance with DoD and Air Force requirements.
Ensure system deliverables comply with DoD and Air Force cybersecurity policies, including DoDI 8500.01 and AFI 17-130.
Ensure compliance with DoD and Air Force certification and accreditation policies, including DoDI 8510.01 and AFI 17-101.
Support activities and requirements under DoDI 8520.02 to achieve standardized PKI-supported biometrics, digital signatures, encryption, identification, and authentication capabilities.
Ensure application deliverables comply with Public Law 111-383 software assurance requirements.
Ensure application deliverables comply with the DISA Application Security Development Security Technical Implementation Guide, including source code scanning to mitigate SQL injection, cross-site scripting, and buffer overflow vulnerabilities.