Information System Security Officer

Booz Allen Hamilton•Reston, VA

1d•$99,000 - $225,000•Onsite

About The Position

Booz Allen is seeking an Information System Security Officer (ISSO) to assess cybersecurity tools and help government clients develop secure, effective solutions. The role involves detecting, evaluating, and documenting the security configurations and impacts of developmental and operational tools, then recommending improvements. The ISSO coordinates with internal teams, subcontractors, and vendors to select tools and techniques that address client IT needs and future goals, and leads network design analysis to balance security with mission requirements. As an information security risk specialist, the ISSO advises clients by leading cyber-risk discovery, interpreting applicable policies, and developing mitigation plans. The role oversees analysis of technical, environmental, and personnel information supplied by subject matter experts and engineers, and guides clients through action plans using presentations, whitepapers, and milestones. The ISSO translates security concepts for client decision-makers and shares cloud technology expertise with clients and teammates. The position is not listed as remote. Locations include Reston, Virginia, with additional locations in Norfolk, Virginia; Riverdale, Maryland; and Washington, District of Columbia. The projected annual compensation range is $99,000 to $225,000.

Requirements

At least 3 years of experience as an Information System Security Officer (ISSO) or Information System Security Analyst (ISSA).
Experience conducting tool assessments and configuration analysis against best practices, vendor specifications, and government security guidelines and requirements.
Experience implementing, overseeing, and maintaining system security configurations, practices, and procedures.
Experience implementing controls from NIST 800-53, FedRAMP, ICD 503, RMF, and DoD Information Levels, including applying them to IT solution design and implementation to achieve an authorization to operate (ATO).
Experience with eMASS or Xacta IA Manager.
Ability to perform risk analysis.
Active TS/SCI clearance and willingness to take a polygraph exam.
One of the following education and IT-project experience combinations: high school diploma or GED and 7+ years; associate degree and 5+ years; bachelor's degree and 3+ years; or master's degree and 1+ years supporting IT projects and activities.
DoD 8570 IAT Level II certification, such as CCNA-Security, CySA+, GICSP, GSEC, Security+ CE, CND, or SSCP.
DoD 8570.01-M CSSP Infrastructure Support certification, such as CEH, CySA+, GICSP, SSCP, CHFI, CFR, Cloud+, or CND.

Nice To Haves

Experience with DoD security technical implementation guides (STIGs), checklists, and testing tools, including STIG Viewer, SCAP, and ACAS scanning tool.
Experience assessing configuration changes, such as new COTS tools or web application upgrades, to a system security boundary.
Experience drafting tool implementation CONOPS and reviewing tool or capability topologies, CONOPS, and vulnerability scans to assess risk.
Experience with cyber-related tools such as Ansible, Terraform, Splunk, or STIG Viewer.
Knowledge of cloud-native security tools, including HBSS.
Knowledge of Zero Trust principles and concepts.
Ability to plan and conduct security authorization reviews and assurance case development for initial system and network installation.
Ability to work collaboratively in a fast-paced, dynamic environment.
Excellent written, organizational, presentation, and verbal communication skills.
AWS, Azure, or GCP certification.

Responsibilities

Assess developmental and operational cybersecurity tools by detecting, evaluating, and documenting their security configurations and impacts.
Recommend improvements based on tool assessments and configuration analysis.
Coordinate with in-house teams, subcontractors, and vendors to identify appropriate tools and techniques for client IT needs and goals.
Lead critical network design reviews, providing alternatives and tailoring solutions to balance security and mission requirements.
Lead discovery of client cyber risks, understand applicable policies, and develop mitigation plans.
Oversee analysis of technical, environmental, and personnel details from subject matter experts and engineers as the team reviews the threat landscape.
Guide clients through plans of action using presentations, whitepapers, and milestones.
Translate security concepts to clients to support decisions about securing mission-critical systems.
Share cloud technology skills with clients and the team.