Information System Security Officer

Pantex•Amarillo, TX

3d•Onsite

About The Position

The Cyber Security Professional is responsible for the Assessment and Authorization (A&A) of Federal information systems, as well as the development of accreditation and other required cybersecurity documentation for new and existing systems. Additionally, this person will utilize various network tools for continuous monitoring of Information Technology (IT) assets. This role encompasses the responsibilities of the Information System Security Officer (ISSO) and/or the Security Control Assessor (SCA) for classified and unclassified information systems. The position requires and understanding of the National Institute of Standards and Technology (NIST) Risk Management Framework (RMF) as well as Department of Energy (DOE) and National Nuclear Security Adminstration (NNSA) cybersecurity directives. The role includes executing assessment and authorization activities, developing and maintaining cybersecurity documentation, performing continuous monitoring, and collaborating with technical stakeholders to ensure that cybersecurity controls and risk management activities align with DOE and NNSA policies and mission needs, while also staying up to date on the latest cybersecurity risks and threats.

Requirements

Bachelor's degree in engineering/science/information technology discipline: Minimum 2 years of relevant experience.
OR Master's degree in engineering/science/information technology discipline.
OR applicants without a bachelor's degree may be considered based on a combination of at least 10 years of completed education and/or relevant experience.
Requires a Q clearance; however all qualified candidates will be considered regardless of their current clearance status.
The ability to obtain and maintain a Department of Energy Q clearance is required.
Position may require entry into Materials Access Areas (MAA) and participation in the Human Reliability Program (HRP).
If HRP is required, candidate must complete a counterintelligence-scope polygraph, pursuant to 10 Code of Federal Regulations (CFR) 709.
Medical requirements may apply.
Pantex is a drug-free workplace.
Candidates accepting a job offer will be required to pass a pre-placement physical, drug screening and background investigation.
As an employee, you may be required to receive and maintain a security clearance from the United States Department of Energy in order to meet eligibility requirements for access to sensitive information or matter.
U.S. citizenship is a requirement for security clearance applicants.
All employees are subject to random selection for drug testing without advance notification.

Nice To Haves

Knowledge of computer networking concepts and protocols, and network security methodologies
Knowledge of risk management processes (e.g., methods for assessing and mitigating risk)
Knowledge of cybersecurity and privacy principles
Knowledge of cybersecurity threats and vulnerabilities
Knowledge of Security Assessment and Authorization process
Knowledge of RMF best practices
Ability to present administrative, technical, and operational information clearly and effectively through the oral and written word as well as diagrams and charts
Knowledge of NIST 800-53/53A security controls
Ability to assess and provide written assessments of A&A packages
Understanding of RMF in the Department of Energy (DOE) Community
Security+, Certified Ethical Hacker (CEH) Certification or Certified Information Systems Security Professional (CISSP) Certification
FedRAMP and Cloud compliance experience
Knowledge of IT security principles and methods (e.g., firewalls, demilitarized zones, encryption)
Knowledge of Application Security Risks
Knowledge of laws, regulations, policies, and ethics as they relate to cybersecurity and privacy
Knowledge of Supply Chain Risk Management Practices (NIST SP 800-161)
Knowledge of Personally Identifiable Information (PII) data security standards
Knowledge of authentication, authorization, and access control methods
Knowledge of database systems
Knowledge emerging technologies that have potential for exploitation
Knowledge of system and application security threats and vulnerabilities (e.g., buffer overflow, mobile code, cross-site scripting, Procedural Language/Structured Query Language (PL/SQL) and injections, race conditions, covert channel, replay, return-oriented

Responsibilities

A&A of Federal information systems
Development of accreditation and other required cybersecurity documentation for new and existing information systems
Conduct independent comprehensive assessments of the management, operational, and technical security controls, and control enhancements employed within, or inherited, by an IT system, to determine the overall effectiveness of the controls
Perform continuous monitoring of IT assets
Develop risk assessments and the proper mitigations
This role includes responsibilities of the ISSO and/or the SCA or classified and unclassified IT systems
Perform other duties as assigned
Ensure systems adhere to applicable federal, DOE, and NNSA cybersecurity policies, standards, and guidelines
Support system owners during the system lifecycle, including security impact analyses for changes and configuration updates
Maintain system security documentation, including System Security Plans (SSPs), contingency plans, and configuration baselines
Coordinate with auditors, assessors, and external reviewers during cybersecurity inspections and evaluations