Information System Security Officer II

Reflexive Concepts•Hanover, MD

About The Position

Reflexive Concepts is seeking an Information System Security Officer II to provide security architecture and systems engineering support for ICAM projects and guide the team through system accreditation, including IATT and ATO. The role owns security documentation, continuous monitoring, and accreditation packages, and works closely with the ISSM, DAOs, developers, and system administrators. The position includes preparing and maintaining security documentation and accreditation artifacts, evaluating security posture through continuous monitoring and vulnerability assessments, coordinating required changes and patching, reviewing audit logs, and tracking assessment and authorization statuses. It also requires weekly data transfers, driving from the Hanover office to Fort Meade, and supporting new PRIVAC requests and extensions.

Requirements

Ten years of relevant work experience, including at least four years as an ISSO on programs and contracts of similar scope, type, and complexity.
Bachelor’s degree in a technical discipline from an accredited college or university, or an additional four years of experience in place of the degree, for a total of fourteen years.
IAM Level 1 CWIP certification, plus one of the following baseline certifications: CAP, CND, Cloud+, GSLC, Security+ CE, HCISPP, CASP+ CE, CISM, CISSP or CISSP Associate, or CCISO.
Experience with the ICD 503/NIST 800-53 certification and accreditation process.
Experience with the Risk Management Framework (RMF).
Experience developing and maintaining SSPs.
Experience with IAVA review and handling.
Experience interpreting security scan results.
Experience interfacing with system administrators and software engineers.
Experience with task-tracking systems such as Jira, Redmine, or ServiceNow.
Understanding of Public Key Infrastructure (PKI)-based authentication.
Understanding of security policies, especially within the IC.
Understanding of the fundamentals of technical security risk assessment.
Understanding of how to perform an analysis of alternatives.
Ability to clearly communicate ideas and status updates to management and other stakeholders.

Nice To Haves

Ability to work in a collaborative environment with minimal supervision.

Responsibilities

Prepare the system security plan (SSP) and provide recommendations to help obtain ATOs.
Identify, develop directly or with applicable experts, review, and incorporate RMF accreditation package artifacts, including system architecture and boundaries, hardware and software lists, risk assessment reports, POA&Ms, data flows, and system, network, and application documentation.
Work with the ISSM and DAOs to help systems obtain and maintain accreditation.
Verify package submissions meet approval thresholds, including C&A packages for system reauthorization, SAR findings, CTOs, POA&Ms, and SSPs.
Apply continuous monitoring techniques to evaluate the system’s security posture.
Create tasking for developers and system administrators when changes and patching are required.
Oversee implementation of software patches to maintain the organization’s security posture.
Implement and enforce information systems security policies, standards, and methodologies.
Use vulnerability scanning and assessment tools, such as ACAS/Nessus, to identify and document compliance.
Review audit logs weekly.
Perform weekly data transfers, driving from the Hanover office to Fort Meade.
Maintain and report assessment and authorization statuses and issues in accordance with organizational guidance.
Understand the PRIVAC process and support personnel with new PRIVAC requests and extensions.