Information Systems Security Officer - Cloud Security Specialist

UIC Alaska • Arlington, VA

8d • Onsite

About The Position

Bowhead seeks an Information Systems Security Officer – Cloud Security Specialist to support its customer on the Nautical contract in the Arlington, Virginia area. The role ensures information systems security compliance and manages security controls for DoD cloud migration projects. It coordinates security accreditation activities and maintains the ongoing security posture of cloud-based systems.

The position applies DoD and NIST security standards, supports Risk Management Framework (RMF) processes, conducts security assessments and vulnerability analyses, manages compliance documentation, and helps coordinate incident response. The role also applies cybersecurity and privacy principles, cloud access controls, hardening techniques, vulnerability management tools, and encryption practices. The employee must handle classified information properly and maintain eligibility for Top Secret clearance with SCI and SAP eligibility.

This position does not allow work from home. U.S. citizenship is required. The target salary range is $160,000–$180,000, commensurate with experience; the employer notes that compensation also depends on factors such as responsibilities, experience, education, skills, internal equity, and business considerations.

Requirements

• Bachelor’s degree in Cybersecurity, Information Systems, Information Technology, Computer Science, or a related field from an ABET-accredited or CAE-designated institution, or 10 years of experience in lieu of the degree.
• At least 16 years of information security experience, including demonstrated expertise in cloud security.
• At least 5 years of DoD security experience in enterprise environments.
• At least 3 years of hands-on experience with cloud security frameworks and implementations.
• Complete understanding of and experience implementing NISPOM and ICD requirements.
• Knowledge of cloud security principles and FedRAMP requirements.
• Meet the Core and Additional Knowledge, Skills, and Abilities Tasks defined in the DoD Cyber Workforce Framework.
• Demonstrated ability to develop solutions to complex security problems.
• Ability to work in fast-paced, deadline-driven environments.
• Excellent verbal and written communication skills for technical and executive audiences.
• Recent experience with security management policies and procedures.
• Proficiency with Microsoft Office Suite and security management tools.
• Required certification: CISSP, CISM, or equivalent DoD Directive 8570-compliant certification, and CompTIA Security+.
• Must be able to maintain a Top Secret security clearance with SCI eligibility and SAP eligibility.
• U.S. citizenship is required for the contract.
• Must be able to lift 25 pounds occasionally, stand and walk for prolonged periods, and twist, bend, and squat periodically.

Nice To Haves

• Desired certifications include GCIH, GSEC, CISSP, CISA, FITSP-M, GCSA, GISF, SSCP, CEH, or other advanced security certifications.

Responsibilities

• Implement and maintain security controls for cloud-based systems in accordance with NIST 800-53 and DoD standards.
• Conduct security assessments and vulnerability analyses of cloud infrastructure.
• Manage security documentation and compliance reporting for continuous monitoring programs.
• Coordinate with Authorizing Officials on system accreditation and Risk Management Framework processes.
• Monitor security incidents and coordinate response activities across cloud environments.
• Maintain security awareness training programs and ensure personnel comply with DoD security requirements.
• Support continuous monitoring and security control assessments for cloud-based information systems.
• Conduct vulnerability scans and identify cloud-based vulnerabilities in security systems.
• Use DoD network analysis tools, such as ACAS and HBSS, to identify cloud-based vulnerabilities.
• Apply system, network, and operating system hardening techniques in cloud environments.
• Conduct cloud application vulnerability assessments and penetration testing.
• Identify systemic security issues by analyzing vulnerability and configuration data.
• Apply cybersecurity and privacy principles to organizational requirements, including confidentiality, integrity, availability, authentication, and non-repudiation.
• Use Tenable Assured Compliance Assessment Solution (ACAS) for vulnerability management.
• Manage Trellix Endpoint Security System (ESS), formerly known as McAfee Host Based Security System (HBSS).
• Apply cloud-based access controls, including access control lists, LDAP, and Active Directory.
• Configure and maintain VPN devices and encryption protocols.
• Troubleshoot and diagnose cyber defense infrastructure anomalies and work toward resolution.
• Perform impact and risk assessments for cloud security implementations.
• Develop insights into organizational threat environments to improve risk management posture.
• Ensure understanding and implementation of NISPOM and ICD requirements.
• Plan, schedule, and prioritize security activities to accomplish mission objectives.
• Handle classified information according to applicable procedures and security protocols.
• Perform other duties as assigned.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior