Information Systems Security Engineer

Amyx•St. Louis, MO

About The Position

Amyx is seeking an Information Systems Security Manager-Intermediate to support its Cybersecurity Division/NGA Defender in the NCW St. Louis, Missouri area. The position is responsible for the cybersecurity of a program, organization, system, or enclave. It leads and oversees information security strategy, architecture, resources, policies, risk management, compliance, continuity planning, security monitoring, incident response, procurement, and workforce awareness and training. The role advises senior management and Authorizing Officials on security posture, risks, and program costs and benefits, and coordinates cybersecurity activities with internal and external stakeholders. The position supports information security throughout the system life cycle, including integrating and validating security requirements, evaluating development efforts and technology changes, participating in acquisition and risk assessment processes, tracking remediation actions, and ensuring that safeguards and policies are implemented effectively. It also prepares and maintains security plans and guidance, provides technical and incident information to higher headquarters, and promotes security awareness across the organization. The role requires a bachelor's degree or higher, an active TS/SCI clearance, and one of the listed DoD 8140 certifications. The physical demands include extended workstation and computer use, communication, and occasionally lifting or moving items typically weighing less than 20 pounds. Regular and predictable attendance is essential.

Requirements

Bachelor’s degree or higher from an accredited college or university.
TS/SCI clearance.
One of the following DoD 8140 certifications: CAP, CASP+, CCISO, CCSP, CISM, CISSP, Cloud+, or SSCP.
Skill in creating policies that reflect system security objectives.
Skill in determining how a security system should work, including its resilience and dependability, and how changes in conditions, operations, or the environment affect outcomes.
Skill in evaluating the trustworthiness of a supplier and/or product.
Ability to apply techniques for detecting host- and network-based intrusions using intrusion detection technologies.
Ability to integrate information security requirements into acquisition, use applicable baseline security controls as a source for requirements, ensure robust software quality control, and establish multiple sources or delivery routes for critical system elements.
Ability to identify critical infrastructure systems with information and communication technology that were designed without system security considerations.
Ability to communicate accurate information.
Ability to sit at a workstation for extended periods; use hands to handle or feel objects, tools, or controls; reach with hands and arms; and talk and hear.
Ability to use a desktop or laptop computer for extended periods to read, review, and analyze information and prepare written recommendations, summaries, or reports.
Ability to occasionally lift and/or move moderate amounts of weight, typically less than 20 pounds.
Regular and predictable attendance.

Nice To Haves

An accredited degree in Computer Science, Cyber Security, Information Technology, Software Engineering, Information Systems, or Computer Engineering is recommended; a degree in Mathematics or an Engineering field is also recommended.

Responsibilities

Acquire and manage leadership, financial, staffing, and other resources needed to support IT security objectives, reduce organizational risk, and maintain continuity of operations.
Advise senior management on risk levels, security posture, and cost-benefit considerations for information security programs, policies, processes, systems, and components.
Inform senior leadership or the Authorizing Official of changes affecting the organization’s cybersecurity posture.
Collect and maintain data for system cybersecurity reporting and communicate the value of IT security throughout the organization.
Collaborate with stakeholders to establish enterprise continuity-of-operations strategy and mission assurance, and integrate cybersecurity requirements into continuity planning.
Ensure security improvement actions are evaluated, validated, and implemented; coordinate cybersecurity inspections, tests, and reviews.
Ensure protection and detection capabilities follow the information systems security engineering approach and align with organizational cybersecurity architecture.
Establish enterprise information security architecture in alignment with the organization’s security strategy.
Evaluate and approve development efforts to ensure baseline security safeguards are installed, and assess cost-benefit, economic, and risk factors in decision-making.
Identify alternative information security strategies, implications of new technologies or upgrades, and security requirements for new IT capabilities.
Coordinate with external organizations on appropriate dissemination of incident and Computer Network Defense information.
Interpret security requirements, noncompliance patterns, and their impact on organizational risk and cybersecurity effectiveness.
Lead and align IT security priorities with security strategy; oversee the information security budget, staffing, and contracting.
Manage monitoring of information security data sources and publishing of Computer Network Defense guidance.
Monitor and evaluate cybersecurity safeguards to ensure they provide the intended protection.
Oversee information security training and awareness programs and provide direction to IT personnel on cybersecurity awareness and training.
Participate in information security risk assessments during Security Assessment and Authorization and in development or modification of cybersecurity program plans and requirements.
Prepare, distribute, and maintain plans, instructions, guidance, and standard operating procedures for secure network system operations.
Provide enterprise cybersecurity and supply chain risk management guidance for continuity plans.
Provide system-related cybersecurity requirements for statements of work and procurement documents, and participate in acquisitions using appropriate supply chain risk management practices.
Provide technical documents, incident reports, examination findings, summaries, and situational awareness information to higher headquarters.
Recognize and report possible security violations; supervise or manage protective or corrective measures for cybersecurity incidents and vulnerabilities.
Recommend resources needed to securely operate and maintain cybersecurity requirements; recommend policy and coordinate its review and approval.
Track audit findings and recommendations and ensure appropriate mitigation actions are taken.
Use federal and organization-specific documents to manage computing environment operations.
Promote management awareness of security issues and ensure sound security principles are reflected in organizational goals.
Oversee policy standards and implementation strategies to ensure procedures and guidelines comply with cybersecurity policies.
Participate in risk governance by providing security risks, mitigations, and input on other technical risks.
Evaluate procurement effectiveness in addressing information security requirements and supply chain risks, and recommend improvements.
Identify system-specific security requirements across all phases of the IT system life cycle.
Ensure plans of action and milestones or remediation plans address vulnerabilities identified during assessments, audits, and inspections.
Assure successful implementation and functionality of security requirements and IT policies and procedures consistent with organizational mission and goals.
Support compliance activities, including security configuration guidelines and compliance monitoring; continuously validate compliance with applicable policies, guidelines, procedures, regulations, and laws.
Ensure acquisitions, procurements, and outsourcing efforts address information security requirements consistent with organizational goals.
Forecast ongoing service demands and review security assumptions as necessary.
Define or implement policies and procedures to protect critical infrastructure, as appropriate.
Communicate accurate information effectively.
Meet physical demands including extended workstation and computer use, occasional lifting or moving of items typically weighing less than 20 pounds, and regular and predictable attendance.