Information Systems Security Officer - Cloud Security Specialist

Bowhead•Arlington, VA

10d•$160,000 - $180,000•Onsite

About The Position

Bowhead seeks an Information Systems Security Officer (ISSO Cloud) to support its customer on the Nautical contract in the Arlington, Virginia area. The role ensures information systems security compliance and manages security controls for DoD cloud migration projects, while coordinating security accreditation activities and maintaining ongoing security posture. The position implements DoD and NIST security requirements across cloud-based systems, performs assessments and vulnerability analyses, supports Risk Management Framework (RMF) and accreditation activities, and contributes to continuous monitoring and incident response. It also involves managing security documentation, access controls, security tools, and cloud infrastructure protections; handling classified information appropriately; and applying NISPOM, ICD, cybersecurity, and privacy requirements. This position does not offer work-from-home capabilities. The candidate must be able to maintain a Top Secret clearance with SCI eligibility and SAP eligibility. U.S. citizenship is required for the contract.

Requirements

Bachelor's degree in Cybersecurity, Information Systems, Information Technology, Computer Science, or a related field from an ABET-accredited or CAE-designated institution, or 10 years of experience in lieu of the degree.
At least 16 years of information security experience, with demonstrated expertise in cloud security.
At least 5 years of DoD security experience in enterprise environments.
At least 3 years of hands-on experience with cloud security frameworks and implementations.
Complete understanding of and experience implementing NISPOM and ICD requirements.
Knowledge of cloud security principles and FedRAMP requirements.
Meet the Core and Additional Knowledge, Skills, and Abilities Tasks (KSATs) defined in the DoD Cyber Workforce Framework.
Demonstrated ability to develop solutions to complex security problems.
Ability to work in fast-paced, deadline-driven environments.
Excellent verbal and written communication skills for technical and executive audiences.
Recent experience with security management policies and procedures.
Proficiency with Microsoft Office Suite and security management tools.
Required certification: CISSP, CISM, or an equivalent DoD Directive 8570-compliant certification, and CompTIA Security+.
Must be able to maintain a Top Secret security clearance with SCI eligibility and SAP eligibility.
U.S. citizenship is required for this contract.
Must be able to lift 25 pounds occasionally, stand and walk for prolonged periods, and twist, bend, and squat periodically.

Nice To Haves

Desired certifications include GCIH, GSEC, CISSP, CISA, FITSP-M, GCSA, GISF, SSCP, CEH, or other advanced security certifications.

Responsibilities

Implement and maintain security controls for cloud-based systems in accordance with NIST 800-53 and DoD standards.
Conduct security assessments and vulnerability analyses of cloud infrastructure.
Manage security documentation and compliance reporting for continuous monitoring programs.
Coordinate with Authorizing Officials on system accreditation and Risk Management Framework (RMF) processes.
Monitor security incidents and coordinate response activities across cloud environments.
Maintain security awareness training programs and ensure personnel comply with DoD security requirements.
Support continuous monitoring and security control assessments for cloud-based information systems.
Conduct vulnerability scans and identify cloud-based vulnerabilities in security systems.
Use DoD network analysis tools, including ACAS and HBSS, to identify cloud-based vulnerabilities.
Apply system, network, and operating system hardening techniques for cloud environments.
Conduct cloud-based application vulnerability assessments and penetration testing.
Identify systemic security issues by analyzing vulnerability and configuration data.
Apply cybersecurity and privacy principles to organizational requirements, including confidentiality, integrity, availability, authentication, and non-repudiation.
Use Tenable Assured Compliance Assessment Solution (ACAS) for vulnerability management.
Manage Trellix Endpoint Security System (ESS), previously known as McAfee Host Based Security System (HBSS).
Apply cloud-based access controls, including access control lists, LDAP, and Active Directory.
Configure and maintain VPN devices and encryption protocols.
Troubleshoot and diagnose cyber defense infrastructure anomalies and work through their resolution.
Perform impact and risk assessments for cloud security implementations.
Develop insights into organizational threat environments to improve risk management posture.
Ensure understanding and implementation of NISPOM and ICD requirements.
Plan, schedule, and prioritize security activities to accomplish mission objectives.
Handle classified information according to proper procedures and security protocols.
Perform other duties as assigned.