Senior Information System Security Officer

Steampunk•McLean, VA

6d•$90,000 - $140,000•Onsite

About The Position

Steampunk is seeking a Senior Information System Security Officer (ISSO) to support a government customer onsite in Washington, D.C. The role supports activities that maintain the security level documented in security authorizations at an acceptable level of risk. The successful candidate demonstrates initiative, organization, responsibility, customer service, flexibility, and sound judgment when handling sensitive and confidential information, and communicates effectively with stakeholders at all levels in a fast-paced environment. The ISSO manages system security and authorization activities, including POA&Ms, risk documentation, annual assessments, contingency planning, ongoing authorization, vulnerability and patch management, audits, configuration management, and compliance with applicable legislation, regulations, and policies. The role also coordinates with customer privacy, records, and information governance teams, supports security integration in development and DevOps processes, and uses DHS and mandated enterprise information assurance compliance tools.

Requirements

Five to ten years of information assurance experience, including at least three years of FISMA-related experience.
Bachelor's degree in a related IT field, or four additional years of FISMA-related experience in place of the degree, for a total of nine to fourteen years of experience.
One of the following certifications: CISSP, CompTIA CASP, CISA, CEH, or CISM.
Specialized knowledge of financial audit standards, classified system information assurance requirements, and Privacy Act requirements.
Specialized knowledge and experience implementing the NIST SP 800 publication family, particularly publications associated with the Risk Management Framework.
Knowledge and experience evaluating system, network, or infrastructure security controls against requirements such as FISMA, FIPS, and NIST guidelines.
Knowledge and experience with vulnerability scanning execution, assessment, and analysis.
Operating system and network knowledge, including LANs and WANs.
Knowledge and experience with information security and assurance principles, such as defense-in-depth, and supporting technologies.
Knowledge and experience with application, database, and network security.
Ability to assess and weigh current and evolving security threats in an operational environment.

Nice To Haves

Current experience providing ISSO support to CBP or DHS.
Experience supporting systems hosted in cloud environments.
Experience supporting systems in Agile and DevOps environments.

Responsibilities

Create, monitor, and update POA&Ms to ensure weaknesses are resolved according to scheduled completion dates.
Create waivers or risk acceptance memoranda to support effective system-risk management.
Conduct annual assessments in accordance with the DHS Information Security Performance Plan.
Review and update security authorization documents as needed and at least annually.
Coordinate with the customer's Privacy, Records, and Information Governance Divisions on compliance documentation and other requirements.
Conduct contingency plan tests at least annually and update the plan.
Perform system self-assessments as part of the customer's Ongoing Authorization program.
Monitor and respond to Information Security Vulnerability Management (ISVM) and patch management matters.
Provide audit support for assigned systems before, during, and after financial, A-123, FISMA, internal, DHS, and other audits.
Maintain knowledge of the inventory within the accreditation boundary.
Ensure security requirements are included in development cycles, including Waterfall, Agile, and SecDevOps.
Use DHS and mandated enterprise information assurance compliance tools.
Devise a plan to certify and accredit assigned information systems.
Ensure configuration management processes are followed so changes do not introduce new security risks.
Manage system ISVM compliance.
Respond to emerging requirements and policies established by legislation, regulation, or policy.
Participate in DevOps security requirements for assigned systems.
Support annual assessments in accordance with the DHS Information Security Performance Plan.