Information Systems Security Engineer

Amyx, Inc.•St. Louis, MO

About The Position

Amyx is seeking an Information Systems Security Manager-Intermediate to support its Cybersecurity Division/NGA Defender in the NCW St. Louis, Missouri area. The position is responsible for the cybersecurity of a program, organization, system, or enclave. It leads and supports enterprise information security strategy, architecture, risk management, compliance, continuity planning, incident response, procurement, and security operations. The role advises senior management and authorized officials on cybersecurity posture, risk, and program costs; coordinates security activities with internal and external stakeholders; and oversees security resources, personnel, policies, training, safeguards, and remediation actions. The position also supports cybersecurity requirements throughout system acquisition and lifecycle activities, including supply-chain risk management, procurement documentation, configuration guidance, and compliance monitoring. It prepares and maintains security plans and guidance, monitors security data and safeguards, supports risk assessments and governance, and communicates reports and situational-awareness information to higher headquarters. The posting lists the role as Information Systems Security Manager-Intermediate in its overview, although the supplied job title is Information Systems Security Engineer.

Requirements

Bachelor's degree or higher from an accredited college or university.
TS/SCI clearance.
DoD 8140 certification: CAP, CASP+, CCISO, CCSP, CISM, CISSP, Cloud+, or SSCP.
Skill in creating policies that reflect system security objectives.
Skill in determining how a security system should work, including resilience and dependability, and how changes in conditions, operations, or the environment affect outcomes.
Skill in evaluating the trustworthiness of suppliers and products.
Ability to apply intrusion-detection techniques using host- and network-based technologies.
Ability to integrate information security requirements into acquisition, use baseline security controls as a source for requirements, ensure robust software quality control, and establish multiple sources for critical system elements.
Ability to identify critical infrastructure systems using information and communication technology that were designed without system security considerations.
Ability to communicate accurate information.

Nice To Haves

Recommended degree fields include Computer Science, Cyber Security, Information Technology, Software Engineering, Information Systems, Computer Engineering, Mathematics, or Engineering.

Responsibilities

Acquire and manage leadership support, financial resources, and security personnel to support IT security goals and reduce organizational risk.
Acquire resources to conduct an effective enterprise continuity-of-operations program.
Advise senior management on risk levels, security posture, and cost-benefit considerations for information security programs, policies, processes, and systems.
Advise senior leadership or the Authorizing Official of changes affecting the organization's cybersecurity posture.
Collect and maintain data needed for system cybersecurity reporting.
Communicate the value of IT security to organizational stakeholders at all levels.
Collaborate with stakeholders on the enterprise continuity-of-operations program, strategy, and mission assurance.
Ensure security improvement actions are evaluated, validated, and implemented as required.
Coordinate cybersecurity inspections, tests, and reviews for the network environment.
Integrate cybersecurity requirements into continuity planning for systems and organizations.
Ensure protection and detection capabilities are acquired or developed using an information security engineering approach consistent with organization-level cybersecurity architecture.
Establish the enterprise information security architecture in alignment with the organization's security strategy.
Evaluate and approve development efforts to ensure baseline security safeguards are installed appropriately.
Evaluate cost-benefit, economic, and risk analyses in decision-making.
Identify alternative information security strategies that address organizational security objectives.
Identify IT security program implications of new technologies and technology upgrades.
Coordinate with external organizations to ensure appropriate and accurate dissemination of incident and Computer Network Defense information.
Interpret or approve security requirements related to new information technology capabilities.
Interpret noncompliance patterns to assess their effect on risk and enterprise cybersecurity program effectiveness.
Lead and align IT security priorities with the security strategy.
Lead and oversee information security budgets, staffing, and contracting.
Manage monitoring of information security data sources to maintain organizational situational awareness.
Manage publication of Computer Network Defense guidance, including TCNOs, concepts of operations, and Net Analyst Reports.
Monitor and evaluate enterprise cybersecurity safeguards to ensure they provide the intended level of protection.
Oversee information security training and awareness programs.
Participate in information security risk assessments during the Security Assessment and Authorization process.
Participate in development or modification of computer-environment cybersecurity program plans and requirements.
Prepare, distribute, and maintain plans, instructions, guidance, and standard operating procedures for network-system security.
Provide enterprise cybersecurity and supply-chain risk management guidance for Continuity of Operations Plans.
Direct IT personnel to ensure cybersecurity awareness, fundamentals, literacy, and training are provided according to their responsibilities.
Provide system-related cybersecurity requirements for statements of work and other procurement documents.
Provide technical documents, incident reports, computer-examination findings, summaries, and other situational-awareness information to higher headquarters.
Recognize possible security violations and take appropriate reporting action.
Recommend resources required to securely operate and maintain organizational cybersecurity requirements.
Recommend policy and coordinate its review and approval.
Supervise or manage protective or corrective measures when a cybersecurity incident or vulnerability is discovered.
Track audit findings and recommendations to ensure appropriate mitigation actions are taken, using federal and organization-specific documents to manage computing-environment operations.
Promote management awareness of security issues and ensure sound security principles are reflected in organizational vision and goals.
Oversee policy standards and implementation strategies to ensure procedures and guidelines comply with cybersecurity policies.
Participate in risk governance by providing security risks, mitigations, and input on other technical risks.
Evaluate procurement's effectiveness in addressing information security requirements and supply-chain risks, and recommend improvements.
Identify system-specific security requirements across all phases of the system life cycle.
Ensure plans of action and milestones or remediation plans are established for vulnerabilities identified through risk assessments, audits, inspections, and other activities.
Assure successful implementation and functionality of security requirements and IT policies and procedures consistent with organizational mission and goals.
Support compliance activities, including adherence to system security configuration guidelines and compliance monitoring.
Participate in acquisition as necessary, using appropriate supply-chain risk management practices.
Ensure acquisitions, procurements, and outsourcing address information security requirements consistent with organizational goals.
Continuously validate organizational compliance with applicable policies, guidelines, procedures, regulations, and laws.
Forecast ongoing service demands and ensure security assumptions are reviewed as needed.
Define or implement policies and procedures to protect critical infrastructure as appropriate.
Communicate accurate information.
Meet the stated physical and attendance requirements, including occasional lifting of less than 20 pounds and regular, predictable attendance.