Information Assurance Subject Matter Expert

Premier Enterprise Solutions•Washington, DC

1d•Hybrid

About The Position

Provide Information Technology Security/Assurance Services in support of a federal government client, in assessing the organization's information security posture. Research, develop, implement, test and review the organization's information security controls in order to protect information and prevent unauthorized access. Inform users about security measures, explain potential threats, implement security measures and monitor networks. Define, create and maintain the documentation for Security Authorization of each information system in accordance with government requirements. Assess the impacts on system modifications and technological advances. Review systems in order to identify potential security weaknesses, recommend improvements to amend vulnerabilities, implement changes and document upgrades.

Requirements

Active DoD Secret clearance is required
Preferably Bachelor's of Science in Engineering or Computer Science.
At least one of these certifications CISSP, CISA, or CISM.
A minimum of seven (7) years IT experience with knowledge of federal government information security regulations and demonstrated hands-on security control assessment experience.
A minimum of five (5) years experience in conducting Security Assessment and Authorization projects
Working knowledge with NIST Special Publications 800-53, 800-53A, 800-37, and FISMA.
Seasoned Security Analyst and having developed numerous Security Test and Evaluation plans and reports.

Responsibilities

Conducting Security Authorization of GSSs and Applications
Participate in Security Test and Evaluation of networks, operating systems, databases, and applications at various government offices.
Development of Security Test and Evaluation Plans.
Review and evaluate IT and Information Security operational procedures.
Review and evaluation of Information Security Policies, Risk Assessment Reports, System Security Plans, Contingency Plans, Incident Response Plan, existing Security Test and Evaluation Plans/Reports, and other documentation.
Review and determine weaknesses in the information security program.
Conduct risk assessment to determine the level of risk to the IT environment.
Assess security policies, standards, and guidelines.
Identify vulnerabilities and provide corrective recommendations in the form of a Plan of Action and Milestone (POA&M).
Review ATO packages for FedRAMP certified systems.
Conduct monthly risk assessments reviews of FedRAMP certified systems.