Information Systems Security Engineer (ISSE)
About The Position
The ISSE will work as part of a team reviewing and assessing Risk Management Framework (RMF) authorization body of evidence for classified information systems. This includes reviewing documents such as the System Security Plan (SSP), Security Control Traceability Matrix (SCTM), Continuous Monitoring Plan, Incident Response Plan, Access Control Plan, and Security Assessment Plan. The role involves reviewing new and existing systems for technical compliance with directives and data protection across all classification levels, advising on security design and threat/risk assessments, and contributing to technical artifacts like Plans of Action and Milestones (POA&Ms), SCTMs, and Risk Assessment Reports (RARs). Additionally, the ISSE will conduct site visits and assessments to inspect plans and security control implementations and support Incident Response Team (IRT) activities.
Requirements
- DoD 8570 IAT Level II certification or higher (Sec+, CISSP, CASP, etc.)
- 5+ years of implementing NIST 800-53, Rev 4 and the Risk Management Framework (RMF)
- 5+ years of experience with Windows and Linux environments
- 5+ years of experience with virtualization or cloud environments
- 2+ years of using information security and assurance practices and principles
- Strong verbal and written communication skills
- Able to engage with users in a professional manner and present technical concepts plainly to semi-technical customers
- Ability to interface with seasoned Government personnel
- Ability to work in a matrixed team environment and support multiple different efforts as needed
- Must have an active Secret clearance; TS preferred
Nice To Haves
- Other Security related certification (Cloud, SIEM, forensics, Linux, Windows, etc)
- Experience working in a DevSecOps project environment
- Formerly or currently a system administrator, developer, or engineer
- Experience with OpenRMF, eMASS, MS Active Directory, Splunk, ACAS/Nessus, McAfee, Windows, Linux, AWS Security, etc
- Desire to learn new technologies and tools and willing to share your experience with the team
- JSIG or ICD 503 compliance
Responsibilities
- Review new and existing systems for technical compliance with directives and protection of data at all classification levels
- Advise on in-depth security design review and threat/risk assessments
- Provide inputs to technical artifacts, including Plans of Action and Milestones (POA&Ms), Security Control Traceability Matrices (SCTM), and Risk Assessment Reports (RARs)
- Conduct site visits and assessments to inspect plans and security control implementations
- Support Incident Response Team (IRT) activities
Benefits
- Hands-on experience
- Certifications
- Industry training
Stand Out From the Crowd
Upload your resume and get instant feedback on how well it matches this job.
What This Job Offers
Job Type
Full-time
Career Level
Senior
Education Level
No Education Listed
