Information Security Risk Specialist
About The Position
As an Information Security Risk Specialist, you will help government and military clients understand cybersecurity risks and develop mitigation plans. You will gather technical and personnel information from subject matter experts to assess the threat landscape, interpret applicable policies, and guide clients through action plans using presentations, white papers, and milestones. You will translate security concepts to help clients make informed decisions about protecting critical systems and support strategic information security work to protect the nation's cyber infrastructure. The role supports DoD system authorization and Authorization to Operate (ATO) activities, vulnerability analysis and remediation, security assessment and authorization documentation, and Ports, Protocols, and Services Management (PPSM). A Secret clearance and a relevant bachelor's degree are required. The position is with Booz Allen and offers a projected annual compensation range of $61,900 to $141,000, along with benefits and professional development opportunities.
Requirements
- Experience supporting DoD system authorization and Authorization to Operate (ATO) activities.
- Experience analyzing and prioritizing vulnerability scan results, developing and maintaining hardware and software inventories, tracking vulnerabilities, and supporting remediation activities.
- Experience developing and supporting Security Assessment Plans (SAPs), Security Assessment Reports (SARs), RMF artifacts, control assessments, and authorization packages in accordance with DoD RMF requirements.
- Knowledge of Ports, Protocols, and Services Management (PPSM).
- Ability to work in a structured, compliance-driven environment and execute established cybersecurity processes with minimal supervision.
- Secret clearance required.
- Bachelor's degree in Cybersecurity, Information Technology, Computer Science, Information Systems, Data Science, or Software Engineering.
- DoD 8140, 752- Cyber Policy and Strategy Planner, Intermediate Certification.
Nice To Haves
- Experience leading and executing the DoD Risk Management Framework for DoD information systems, including full lifecycle implementation across RMF steps, application of DoD and DoD Component cybersecurity policies, procedures, and directives, and development and management of Plans of Actions and Milestones (POA&M).
- Experience reviewing, interpreting, and enforcing Security Technical Implementation Guides (STIGs) using STIG Viewer.
- Experience using eMASS and ACAS within a DoD environment.
- Top Secret clearance.
- Master's degree.
Responsibilities
- Assist military leaders in identifying cyber risks, understanding applicable policies, and developing mitigation plans.
- Gather technical and personnel details from subject matter experts to assess the threat landscape.
- Guide clients through plans of action using presentations, white papers, and milestones.
- Translate security concepts to support client decisions about securing critical systems.
- Support DoD system authorization and Authorization to Operate (ATO) activities.
- Analyze and prioritize vulnerability scan results, maintain hardware and software inventories, track vulnerabilities, and support remediation activities.
- Develop and support Security Assessment Plans (SAPs), Security Assessment Reports (SARs), RMF artifacts, control assessments, and authorization packages in accordance with DoD RMF requirements.
- Apply knowledge of Ports, Protocols, and Services Management (PPSM).
Benefits
- Health, life, and disability benefits.
- Financial and retirement benefits.
- Paid leave.
- Professional development.
- Tuition assistance.
- Work-life programs.
- Dependent care.
- Recognition awards for exceptional performance and demonstration of company values.
