FISMA Compliance Specialist

JCS Solutions LLC•Bethesda, MD

About The Position

JCS Solutions is seeking a FISMA Compliance Specialist to provide technology leadership for IT security projects and support FISMA compliance for unclassified information systems. The role develops and maintains Authorization to Operate (ATO) packages, advises infrastructure and application teams on applicable policies and regulations, and evaluates security practices against guidelines such as NIST, OMB, FISMA, and HHS. The specialist works with engineering teams to identify NIST 800-53 and compensating controls, assess and mitigate vulnerabilities, and support security monitoring and remediation. The position also involves identifying and reporting cyber-attacks, contributing expertise to investigations, and leading incident response activities across application, infrastructure, and cybersecurity teams according to established plans and procedures. The successful candidate will bring relevant security leadership experience, technical skills with cybersecurity tools, strong communication and organizational abilities, and the ability to obtain a Public Trust Clearance. JCS Solutions describes itself as a technology firm serving defense, national security, and civilian sectors, with a collaborative and inclusive culture and a commitment to investing in its workforce.

Requirements

Must be a U.S. citizen.
Must be able to obtain a Public Trust Clearance.
Six or more years of experience providing technology leadership for IT security projects.
Bachelor’s degree in a technical field such as Cyber Security, Computer Science, Information Systems, IT, or a related field; alternatively, a high school diploma or GED with six additional years of relevant experience, or an associate’s degree with four additional years of experience.
Four to six years of hands-on experience providing technology leadership for IT security projects.
Four or more years of experience with new and emerging cybersecurity technologies, including hands-on use of tools such as BigFix, Splunk, Tripwire, Cylance, or Tenable.
Strong oral communication skills in fluent English and strong writing skills, including experience interacting with and presenting to senior leaders and contract officers.
Strong strategic thinking, multitasking, time-management, planning, and schedule- and budget-execution skills.

Nice To Haves

Expert-level experience with Microsoft Word, PowerPoint, Excel, and Visio.
Experience with data analytics and combining data sets from multiple sources to report risks and measure security posture.
Knowledge of vulnerability dissemination sources such as alerts, advisories, errata, and bulletins.
Experience with incident response handling methodologies.
Knowledge of current industry methods for evaluating, implementing, and disseminating IT security assessment, monitoring, detection, and remediation tools and procedures using standards-based concepts and capabilities.
Prior experience using a helpdesk ticketing system such as ServiceNow.
Prior federal government IT security experience.
At least one of the listed certifications: Certified FISMA Compliance Practitioner (CFCP), Certified Information Systems Auditor (CISA), Certified in Governance, Risk, and Compliance (CGRC), Global Information Assurance Certification (GIAC), CompTIA Advanced Security Practitioner (CASP), Certified Ethical Hacker (CEH), Certified Information Security Manager (CISM), Certified Information Systems Security Professional (CISSP), or Security+ CE.
Experience using ServiceNow or an equivalent platform.

Responsibilities

Provide technology leadership for IT security projects.
Develop and maintain Authorization to Operate (ATO) packages and provide other FISMA compliance support.
Consult with infrastructure and application teams to help them achieve compliance with applicable policies and regulations.
Identify and mitigate vulnerabilities in unclassified information systems.
Conduct ongoing gap analysis of policies, practices, and procedures against guidelines from NIST, OMB, FISMA, HHS, and other applicable sources.
Assist engineering teams in identifying applicable NIST 800-53 controls and compensating controls for unclassified systems.
Test systems and networks for vulnerabilities and address issues with support from infrastructure teams.
Identify and report cyber-attacks and participate in resulting investigations as needed, providing expertise on existing and mitigating security controls.
Lead incident response activities and coordinate response efforts among application, infrastructure, and cybersecurity teams in accordance with defined plans, policies, and procedures.