The SCAR will perform reviews of security artifacts for system authorizations, assessing both the technical and functional adequacy as required for application and software cybersecurity readiness.

Key Responsibilities:

• Evaluating IT infrastructure in terms of risk to the organisation and defining artifacts required to meet Federal, DoD and DAF requirements
• Assessing IT systems and architecture to ensure compliance with the Risk Management Framework (RMF), NIST Cybersecurity Framework (CSF), NIST 800-53 revision 5 and applicable guidance
• Supporting the system/application assessment and authorization (A&A) effort, to include assessing and guiding the quality and completeness of A&A activities, tasks and resulting artifacts mandated by governing DoD and AF policies, and applicable mandates
• Collecting, reviewing and verifying documented business processes within process narratives or flowcharts, identifying risks and validating proficiency of mitigating controls
• Reviewing risk and control matrices and testing plans for key controls and determines effectiveness
• Identifying control gaps, reviewing and testing the design of existing controls
• Formulating clear and concise conclusions on internal controls and business process efficiency
• Recommending policies and procedures to ensure information systems reliability and accessibility and to prevent and defend against unauthorized access to systems, networks, and data
• Conducting risk and vulnerability assessments of installed information systems to identify vulnerabilities, risks, and protection needs
• Reviewing Plans of Actions & Milestones (POA&Ms)
• Providing recommendations and reports to the Security Control Assessor (SCA), Authorizing Official (AO), Chief Information Security Officer (CISO)
• Reviewing network and systems design to ensure accuracy
• Ensuring the rigorous application of information security/cybersecurity policies, principles, and practices in the delivery of all IT services

Required Qualifications:

• 5+ years of relevant Cyber experience
• 5+ years prior experience as a Security Control Assessor/Representative RMF Engineer, ISSO, ISSM and/or information assurance engineer
• Cloud Platform experience with at least one service offering from AWS, Azure, or Google GCP
• Hands-on eMASS and/or Xacta experience completing full system lifecycle activities
• Experience with Air Force risk management policies/procedures, to include, DODI 8510.01, AFI 17-101
• Experience with Cloud Computing Security Requirements Guide (CC SRG)
• Knowledgeable with DoD DevSecOps Fundamentals Playbook
• Experience evaluating information security compliance against STIGs
• Ability to clearly articulate ideas
• Strong technical writing abilities to author reports for AO and CISO dissemination
• Exudes confidence in providing briefings, presentations, and in conducting/guiding meetings with senior leadership and stakeholders
• Ability to use prior experience and knowledge to address new situations
• Certification requirements (at least one of the following): SecurityX / CASP+, CCISO, CGRC/CAP, CISA, CISM, CISSO, CISSP, CISSP-ISSEP, Cloud+, CySA+, FITSP-A, GCSA, GSEC, GSLC, GSNA, PenTest+, Security+
• B.A. or B.S. Information Security, Computer Science or related discipline
• US Citizenship and currently possess a Top Secret security clearance

XML job scraping automation by YubHub

Responsibilities include:

• Providing oversight and enforcement of DoD and Air Force Cyber Security policies and procedures
• Acting as the primary security advisor to the PM, AO, and ISO
• Ensuring compliance with established information security AF requirements
• Overseeing an ISSO Team

Requirements:

• 3 years' experience as an ISSM or 5 years' experience as a Sr. ISSO
• Hands-on experience enforcing information protection policies in an unclassified environment
• Excellent written and verbal communication skills
• At least one of the following cyber security certifications: CASP+, CE/Security X, or CISSP
• Strong experience with DoD and Air Force Risk Management Framework (RMF)
• Proficiency with a major cloud services platform (GCP, Azure, AWS, etc.)
• Bachelor's Degree in Computer Science, Business, or a related field
• Proficiency with Microsoft Office software suite
• U.S. Citizenship with an active Secret security clearance

Desired Qualifications:

• Experience with task management, metrics collection, and status reporting to management
• Proficiency with Google Cloud Platform (GCP) technology
• Demonstrated knowledge/experience in resource allocation, workload management, and contract management
• One or more of the following cyber security certifications: SEC+, SSCP, CASP, GSEC, GICSP, CEH, CDNA, CSSLP
• Experience with common security tools such as Nessus, WASSP, SECSCN, and/or MBSA

The salary range for this position is $140,000.00 - $160,000.00, commensurate with experience and technical skillset.

XML job scraping automation by YubHub