5+ years of experience in Information Assurance or Risk Management Framework for Navy systems as an ISSO or ISSE.
DOD 8140 IAM Level II certification (e.g., Security+ CE, CASP+, CISM, CISSP).
Proficient in reviewing and updating system diagrams.
Knowledge of DoD cybersecurity concepts and tools, including DISA STIGs and ACAS scans.
Experience with Risk Management Framework and Platform Information Technology systems.
Strong written and verbal communication skills for interfacing with technical teams.
Familiarity with Microsoft Visio or Cameo for diagram updates.
Responsibilities
Provide IA support for hardware suites in H20 programs, including system patching and user management.
Prepare authorization documentation for submission to ISSM or DAA, adhering to DoD standards.
Develop IA/cybersecurity guidelines and SOPs, advising users on policies and regulations.
Validate system security requirements and coordinate integration of security capabilities.
Monitor changes in information systems affecting security posture and manage configuration changes.
Develop and review RMF documentation, including SSPs and Risk Assessment Reports.
Conduct annual security reviews and testing of security controls per FISMA requirements.
Benefits
Comprehensive health insurance options.
Retirement savings plan with employer matching.
Professional development opportunities and training.
Flexible work schedule and remote work options.
Paid time off and holidays.
Full Job Description
Description
Provide IA support for the development and tactical hardware suites of equipment for H20 programs and products, including laboratory/land-based systems and operational afloat systems. This support includes coordination of system patching, user management, log management, and respective authorization/assess only documentation preparation and review.
Preparation of the authorization documentation for submission to the respective Information Systems Security Manager (ISSM) or other program specific Designated Approving Authority (DAA), utilizing the appropriate DoD Accreditation standards, policies, and directives.
Develop IA/cybersecurity guidelines and standard operating procedures (SOPs). Analyze policies, regulations, and system provisions governing standard operating systems. Assists and advise users of policies, regulations, and system provisions for the standard operating systems.
Validate and verify system security requirements/controls and coordinate integration of system security capabilities for various environments.
Observe, test, and monitor changes in information systems that might affect the security posture. As the ISSO, the candidate shall perform configuration management for information system security software, hardware, and firmware, and manage changes to systems, assessing their security impact. Additionally, notify ISSM on Cybersecurity issues affecting IT systems and software they are assigned to support.
Develop, update, and/or review RMF documentation to include the System Security Plan (SSP), Security Control Traceability Matrix (SCTM), Plan of Action and Milestone (POA&M), Risk Assessment Report (RAR), and Security Assessment Plan (SAP)
Requirements
Minimum of five (5) years of experience in Information Assurance, Computer Security, or Risk Management Framework for Department of the Navy systems as an ISSO or Information System Security Engineer (ISSE).
DOD 8140 certification at IAM Level II certification (e.g., Security+ CE, CASP+, CISM, CISSP).
Ability to review and update diagrams to accurately reflect system changes.
Have knowledge of DoD-approved cybersecurity concepts and tools including DISA STIGs and Assured Compliance Assessment Solution (ACAS) scans in support of system vulnerability management and reporting.
Perform and review technical security assessments to identify vulnerabilities and ensure compliance with information assurance (IA) standards and regulations. This includes vulnerability status tracking and reporting in DoD systems
Independently prepare and review security documentation, including System Security Plans (SSPs) and Asses Only/Authorization packages. Independently prepare, review, and update authorization packages.
Demonstrated experience with Risk Management Framework and Platform Information Technology (PIT) systems.
Excellent written and verbal communication skills along with ability to interface with project lead, software developers, system integrators, and system administrators.
Experience with Microsoft Visio or Cameo to update system diagrams and defense-in-depth diagrams.
Has knowledge in DoD-approved cybersecurity concepts and tools including DISA STIGs, Security Content Automation Protocol (SCAP) Compliance Checker, Evaluate-STIG, eMASS, ACAS Scans, and Security Center in support of system vulnerability management and reporting. This includes reviewing IAVMs/IAVAs, tracking vulnerability status and reporting in DoD systems. Additionally, able to register new systems and maintain systems in eMASS.
Perform annual security reviews, annual testing of security controls, and annual testing of the contingency plan, in line with FISMA requirements. Familiarity with updating PIA forms annually and eAuthentication every three years, or sooner if needed.
Experience with scanning containers (e.g., Podman and Docker) using Anchore Grype.
Experience using Anchore Syft to generate a Software Bill of Material (SBOM) from container images and filesystems.
The anticipated salary for this position is $75,000 to $135,000.
