Information System Security Lead Consultant

Safal Partners

20h•Remote

About The Position

Safal Partners is seeking an experienced Information System Security Lead to manage the security of a federal project website. Working as a 1099 consultant, the successful candidate will own the website’s security compliance program from start to finish, including continuous monitoring, Risk Management Framework (RMF) documentation, vulnerability management, access control, incident response, and contingency planning in line with ED Information Assurance Services requirements. The role calls for a hands-on federal security professional with FedRAMP and CSAM experience who can keep Authorization to Operate (ATO)-related documentation current and audit-ready. An active U.S. Department of Education Public Trust certification is required. The position is remote in the United States, and candidates must be authorized to work in the United States.

Requirements

U.S. Department of Education security clearance (Public Trust Certification) is required.
FedRAMP experience.
Cyber Security Assessment and Management (CSAM) experience.

Nice To Haves

CompTIA Security+ certification.
Certified in Governance, Risk and Compliance (CGRC, formerly CAP).
Experience supporting federal contracts.

Responsibilities

Execute continuous monitoring tasks per ED Information Assurance Services requirements.
Maintain NIST and Risk Management Framework (RMF) compliance.
Develop and manage Plans of Action and Milestones (POA&Ms).
Conduct annual self-assessments following ED protocols.
Monitor Authorization to Operate (ATO) status and renewals, as relevant.
Implement DHS Binding Operational Directive (BOD) requirements.
Conduct monthly vulnerability scans and remediation.
Oversee identity and access management systems.
Maintain secure access controls and user permissions.
Manage SSL certificate maintenance and updates.
Lead security incident response planning and execution.
Coordinate annual tabletop exercises for the Incident Response Plan.
Track and document security incidents.
Maintain the Contingency Plan (CP) and disaster recovery procedures.
Ensure compliance with Recovery Time and Recovery Point Objectives (RTO/RPO).
Manage system security documentation, including the System Security Plan (SSP).
Maintain security documentation and compliance records.
Generate security assessment reports.
Update security-related standard operating procedures (SOPs).
Optionally support completion of required website/extranet paperwork.