Information Security Analyst

By Light HQ•Scott AFB, IL

14h•Onsite

About The Position

By Light Professional IT Services LLC is seeking an Information Systems Assessment and Authorization analyst to support an IT Service Management effort for USTRANSCOM at Scott Air Force Base in Illinois. The USTC Managed Information Technology Services contract provides strategic, technical, and program management guidance and support for the operations and modernization of the combatant command’s infrastructure, systems, and applications, supporting the USTC Command, Control, Communications & Cyber Systems Directorate (TCJ6). The successful candidate will work on high-visibility or mission-critical program aspects and perform functional duties with some oversight. The position follows normal business hours, Monday through Friday, with possible after-hours and weekend support during planned or emergency events.

Requirements

Bachelor's degree.
At least four years of experience.
At least one IAT Level II certification: Security+, CECCNA-Security, CySA+, GICSP, GSEC, CND, or SSCP.
At least one Computing Environment certification or certificate relevant to the technical area of responsibility, for network support/defense (e.g., Splunk, Cisco, or McAfee) or an operating system (e.g., Microsoft, Linux, or Solaris).
DoD Secret clearance or higher.

Nice To Haves

Master's degree.
ITILv4 Foundations certification.
One IAM Level II certification: CAP, CASP+ CE, CISM, CISSP or Associate, GSLC, CCISO, or HCISPP.

Responsibilities

Develop and coordinate authorization documentation, including system categorization, Systems Security Plans, and system risk assessments.
Manage Authority to Operate packages using continuous monitoring strategies outlined by the ISSM.
Support control assessment, reporting, and monitoring processes using the Cyber Security and Assessment Management (CSAM) system.
Create and maintain minor and major modification documentation.
Maintain waivers and risk assessments for ISSMs.
Assist ISSMs with decisions affecting the security of their systems and networks.
Facilitate preparation for contingency and incident response assessments.
Perform and document risk assessments, analyze security vulnerabilities, and develop metrics to measure the risks associated with vulnerabilities.
Design and develop comprehensive Systems Security Plans describing the infrastructure, policies, and procedures that define the security profile for enclave systems.
Review and validate System Test and Evaluation (ST&E) and Interim Authority to Test (IATT) reviews for new or legacy systems.
Review and conduct NIST-based self-assessments, identify weaknesses, and develop Plans of Action and Milestones (POA&Ms) based on industry best practices.
Request risk acceptance for vulnerabilities that cannot be remediated or mitigated.
Create and track POA&Ms to mitigate risks identified through ACAS and STIG processes.
Design and develop Initial Privacy Assessments and Privacy Impact Assessments for major federal government IT systems.
Use the eMass tool to manage system security profiles.
Use the Ports, Protocols, and Service Management (PPSM) tool and processes to register ports, protocols, and services used by enclaves.