Duties

Help

This position serves an Information System Security Manager (ISSM) for the Information Technology Directorate (MRI), NAF Business and Support Services Division (MR), Manpower and Reserve Affairs Department, Headquarters Marine Corps. The incumbent will provide compliance guidance and tracking for Marine Corps NAFI activities at installations and assist with the improvement of compliance items to Marine Corps installations worldwide.

- Conducts targeted vulnerability assessments via Tenable to identify and prioritize system risks and ensuring infrastructure alignment with strict DISA STIG baselines.

- Generate detailed analytical reports and executive summaries on vulnerabilities and configuration gaps

- Performs security compliance efforts IAW the Payment Card Industry (PCI), Federal Information Security Modernization Act (FISMA), National Institute of Standards and Technology Special Publication (NIST SP) 800 series, Federal Information Processing Standards (FIPS) series, and USMC related policies and procedures.

- Manages scanner configurations, including target IP ranges, schedules, authentication credentials, plugin updates, and STIG audit files.

- Works closely with and receives reports from Program Manager(s), Cyber operational personnel, and system administrators.

- Conducts assessments of continuous monitoring targets, assess level of risk, IT policy deviations from acceptable configurations, and develops and/or recommends appropriate plan of actions and milestones (POA&M).

- Promotes IT security awareness to the user community by validating the user community is completing annual security training.

- Coordinates with all departments within the Marine Corps Community Services (MCCS) and higher Marine Corps to support cybersecurity awareness initiatives.

Occasional travel to complete work assignments, conduct training or attend conferences and meetings may be required. Performs other related duties as assigned.

This is a white-collar position where occasional lifting up to 20 lbs. may be required.

Performs other duties as assigned.

Requirements

Help

Conditions of employment

• See Duties and Qualifications

EVALUATIONS:

Qualifications

Five or more years of experience performing specific tasks for Information System Security Manager (ISSM), security assessments, vulnerability management, or cybersecurity (CY). Demonstrated proficiency in applying vulnerability logic and correlation to relevant assets; tracking and processing remediation actions; performing incident handling and reporting; analyzing, determining, and mitigating risk to servers, applications, and network equipment. Applicable education may be substituted for years of experience.

Knowledge of risk management processes, secure configuration management techniques, Government laws and policies, cyber threats and vulnerabilities, encryption algorithms, host/network access control mechanisms, vulnerability information dissemination sources, Payment Card Industry (PCI) data security standards, Personally Identifiable Information (PII) data security standards, incident response and handling methodologies, intrusion detection methodologies and techniques for detecting host and network-based intrusions, and organization's risk tolerance and/or risk management approach.

Skill in applying security controls, analyzing traffic to identify network devices, conducting application vulnerability assessments, assessing security systems designs, interpreting vulnerability scanner results to identify vulnerabilities, assessing cloud security measures and microservices, preparing Test & Evaluation reports, and running Security Content Automation Protocol (SCAP) content and Security Technical Implementation Guides (STIGS) based tools for benchmark, compliance checks, and security configuration reviews.

Ability to identify systemic security issues based on the analysis of vulnerability and configuration data, apply cybersecurity and privacy principles to organizational requirements (relevant to confidentiality, integrity, availability, authentication, non-repudiation), conduct vulnerability scans and recognize vulnerabilities in security systems, and translate data and test results into evaluative conclusions.

As an authorized and privileged user of Department of Defense Information Systems, must fulfill the requirement to complete DoD Workforce Improvement Program certification (DoD 8570.01-M) as a condition of access within six months of employment. This position has been determined as a Basic proficiency level ISSM.

This position had been determined as Moderate Risk. As a condition of employment, the incumbent must be able to obtain and maintain an Access National Agency Check and Inquiries (ANACI/ Tier 3) Secret Clearance to access classified information.

Benefits

Help

A career with the U.S. government provides employees with a comprehensive benefits package. As a federal employee, you and your family will have access to a range of benefits that are designed to make your federal career very rewarding. Opens in a new windowLearn more about federal benefits.

The Federal government offers a number of exceptional benefits to its employees. Benefits you get to enjoy while working at MCCS include but are not limited to:
• Stability of Federal Civilian Service
• People with passion for doing work that matters
• Quality of Work Life Balance
• Competitive Pay
• Comprehensive Benefit Packages
• Marine Corps Exchange and Base Facility Privileges

Review our benefits

Eligibility for benefits depends on the type of position you hold and whether your position is full-time, part-time or intermittent. Contact the hiring agency for more information on the specific benefits offered.