INFOSEC Specialist/ ISSM

Amentum•Falls Church, VA

6d•$190,000 - $250,000

About The Position

Amentum is seeking a Cyber and Information Security Specialist (INFOSEC) to perform IT project risk assessments for projects on government-sponsored computer networks. The role provides expertise in developing information security policies, standards, guidelines, and procedures, and supports information security compliance for systems used at contractor facilities. The INFOSEC Specialist supports program system owners and service providers throughout the Risk Management Framework (RMF), including Assessment and Authorization (A&A). The position reviews system architectures, supports security planning and reviews, advises on sponsor policies and regulations, investigates cyber incidents, and communicates technical findings and recommendations to technical and non-technical audiences. It also provides information security training and recurring security and activity reports.

Requirements

8–10 years of experience performing the full range of information security functions.
Bachelor’s degree in IT.
Experience with audits, risk management, or internal controls on government systems.
Understanding of or experience with cloud security.
Demonstrated ability to work independently with minimal guidance and in small, dynamic teams, often under time constraints.
A U.S. government-issued Top Secret security clearance with polygraph is required at the time of application.

Nice To Haves

Working knowledge of NISPOM, DCIDS, ICDs, and Executive Orders to ensure security compliance is preferred.

Responsibilities

Review and analyze systems architecture diagrams and networks.
Support Assessment and Authorization (A&A) requirements and processes, applying ICD 503, NISPOM, and other federal guidelines for systems used at contractor facilities.
Assist program system owners and service providers throughout the RMF, including A&A processes.
Produce an annual A&A report covering trends, challenges, risks, recommended mitigations, and process improvements.
Provide oversight and guidance to ensure compliance with program information security regulations and policies for processes and requests, including data transfer, access, service/change, purchase, accountable property management, waivers, equipment introduction into SCIFs, and equipment transport; produce a Weekly Activity Report.
Facilitate the development, maintenance, and security review of AIS security plans for computers, networks, and information systems at contractor facilities, ensuring sponsor and program approving signatures are acquired and documented.
Conduct technical exchange meetings to facilitate AIS security solutions for industrial contractors and government systems, and develop solutions to technically complex systems and challenges.
Ensure documentation is complete and accurate in accordance with sponsor and program AIS policies and requirements.
As necessary, support investigations of virus or malware alerts and incidents to determine root cause, code entry point, and risk of damage, and report findings.
Write reports based on technical analysis of sponsor or industrial partner systems and, when applicable, recommend ways to mitigate future issues.
Analyze systems, including forensically, for malware, misuse, and unauthorized activity.
Ensure cyber incidents and data spills are reported according to program SOP; support investigations and remediation or cleanup, and provide guidance in coordination with program security management and other groups.
Provide information security training and update training materials to reflect current policies, regulations, and best practices.
Participate in project review meetings and provide technical cybersecurity advice and expertise to program personnel.
Advise on the technical and performance characteristics of new technologies in relation to sponsor policies and regulations.
Review complex sponsor and industrial partner system designs for security risks and compliance, and propose resolutions and preventive strategies.
Communicate complex technical concepts, project information, and security policy clearly to technical and non-technical audiences.
Provide briefings and training on the sponsor’s INFOSEC policies and regulations.
Provide a quarterly Security Control Status Report (SCSR) identifying security risks and trends through ranking the 77 Control Families.