Senior Cybersecurity Analyst / Information Systems Security Officer (ISSO)

KBR•Colorado Springs, CO

11d•$120,000 - $140,000•Onsite

About The Position

KBR is seeking a Senior Cybersecurity Analyst/Information Systems Security Officer to work closely with the existing team to ensure systems are operated, maintained, and disposed of in accordance with applicable security policies and procedures. The role supports the operational security of AVAC control systems and networks, including compliance, risk management, continuous monitoring, system authorization, incident response, and secure recovery. The position also involves advising leadership and coordinating with the ISSM, IT personnel, system suppliers, customers, and mission partners.

Requirements

5–10 years of experience.
Top Secret SCI clearance required.
DoDD 8140.01 Security+ certification.
Working knowledge of DoD RMF Rev. 4 and/or Rev. 5, cyber technologies, NIST standards, and DISA STIG governance.
Strong working knowledge of technical control implementation, security control tailoring, accreditation, verification and validation audit concepts, and defense-in-depth.
Experience with RMF controls, eMASS or Xacta, risk assessment, POA&Ms, policy and plans documentation, IAVM, and vulnerability assessment for mission systems.
Effective interpersonal skills and demonstrated ability to support complex organizational relationships.
Excellent technical document preparation and verbal communication skills.
Bachelor’s degree in IT or a cybersecurity-related field, or equivalent related experience, is preferred.

Nice To Haves

Bachelor’s degree in IT or a cybersecurity-related field, or equivalent related experience.
Experience with premise-based isolated, non-connected enclaves.
GSEC, SCNP, SSCP, CISSP, CISA, or higher certification.
Experience in cyber requirements design, development, implementation, deployment, and remediation.

Responsibilities

Manage activities necessary to achieve and maintain the operationally secure posture of AVAC networks, including operation, sustainment, maintenance, and compliance.
Develop and maintain A&A documentation, policies, plans, procedures, and other required artifacts throughout system life cycles.
Develop and manage tailored security policies and procedures that protect control system environments while maintaining system availability.
Develop and execute security control assessment procedures for continuous monitoring and authorization assessments.
Review and advise on updates, patches, and security technical implementations while maintaining control system performance and availability.
Configure and collect control-system audit logs for monitoring and forensic analysis.
Establish and maintain security configuration baselines for control systems, including field devices, IT components, interconnections, and interfaces.
Maintain knowledge of control-system functions and security, including interfacing control systems and IT technologies.
Maintain network segmentation to isolate control systems from business networks and external connections as directed.
Conduct network cyber inspections, assess vulnerabilities, analyze technical requirements, and provide reports recommending cyber requirements, capabilities, and training.
Participate in control-system change management with IT personnel and control-system experts, such as system suppliers.
Analyze technical information, identify problems, and use judgment to develop, evaluate, and execute remediation or mitigation options.
Provide timely, decision-quality technical recommendations to support senior leadership risk acceptance.
Engage with customers and mission partners, anticipate their needs, and deliver effective support.
Conduct technical analyses and assessment reports on cyber requirements, capabilities, training, emerging technologies, and mission capability gaps.
Provide threat analysis, track relevant prioritized incidents, and recommend actions in coordination with the AVAC Cyber Operations team.
Develop and execute Verification & Test plans, including delivery of Risk Assessment Reports and Security Impact Assessments.
Support risk assessments by reviewing and documenting the implementation status of control-system security requirements.
Develop and maintain DoD RMF Rev. 5 eMASS and Xacta packages and required ATO compliance taskings.
Consult with leadership on system security matters, including risk assessment and configuration management.
Perform system design reviews for changes and upgrades, and recommend mitigation or remediation of POA&Ms.
Implement DoD and IC RMF assessment requirements for control systems and document and maintain records.
Develop and maintain system incident and disaster response processes, including secure system recovery.
Advise and coordinate with the ISSM on the program's cybersecurity strategy and direction.

Benefits

401(k) plan with company match
Medical insurance
Dental insurance
Vision insurance
Life insurance
AD&D coverage
Flexible spending account
Disability benefits
Paid time off
Flexible work schedule
Professional training and development
Potential bonus, commission, or other compensation, including sign-on bonus, relocation benefits, short-term incentives, long-term incentives, or discretionary performance payments