Information Security- ISSO (Active Top Secret Clearance Required)

Company: General Dynamics Information Technology
Location: Chantilly
Posted on: May 14, 2020

Job Description:

Type of Requisition: Regular Clearance Level Must Currently Possess: Top Secret Clearance Level Must Be Able to Obtain: Top Secret SCI + Polygraph Suitability: Polygraph Public Trust/Other Required: None Job Family: Information Security Job Description: Responsibilities The ISSO position shall provide comprehensive Information Assurance (IA) support to customer Directorates and Offices.  The ISSO will fall under the agency Information System Security Manager (ISSM) and will provide day-to-day information assurance operations support by ensuring that IA and Operational security practices are maintained for all assigned Information Systems (IS). ISSOs must possess a strong working knowledge of: Information Assurance concepts, to include Assessment and Authorization (A&A) activities General Information Technology (IT) system functions Documented Security policies and best practices Standard technical security safeguards Operational Security (OpSec) measures FISMA Support Ensure compliance with annual Federal Information Security Management Act (FISMA) deliverables and reporting. Develop and maintain Configuration Management Plans (CMP) for software, hardware, and firmware, and serve as a member of the Configuration Management Board, with Information System Security Manager (ISSM) and System Owner concurrence. Develop Information System Contingency Plans (ISCP), Continuity of Operations (COOP) and Disaster Recovery Plans (DRP) and Business Impact Assessments (BIA). Perform ISCP Training and Testing. Develop Incident Response Plans (IRP). Perform IRP Training and Testing. Perform Security Controls Assessments of Information Systems. Ensure general users and privileged users are trained in the specific knowledge needed for them to safely operate and maintain the Information System, to which they have access, including general security awareness and specialized privileged user training. Develop and maintain POA&Ms at least quarterly. Perform monthly vulnerability scanning to include Nessus Vulnerability (Patch Management) and Compliance (STIG) Scans Trustwave AppDetective Database Scans Trustwave AppScan Web Application Scans Develop Privacy Threshold Assessments (PTA) and Privacy Impact Assessments (PIA). Assessment and Authorization Support Ensure the day-to-day implementation, oversight, continuous monitoring, and maintenance of the security configuration, practices, and procedures for each information system during all phases of the IS lifecycle. Knowledge of NIST 800-53 security controls to ensure system implemented and operating as intended during all phases of the information system life cycle. Develop and maintain Security Concept of Operations (SECONOPS) and FISMA documentation prior to system authorization. Support risk assessment and evaluation activities throughout the Assessment and Authorization (A&A) accreditation process. Works closely with the System Administrator to maintain the various system and application A&A status. Develop Plan of Action & Milestones (POA&Ms) in response to reported security vulnerabilities. Manage the risks to information systems by coordinating appropriate correction or mitigation actions, and oversee and track the timely completion POA&Ms. Prepare the Security Test Report (STR) to include findings and recommendations for conducting remediation on deficiencies discovered during security control assessments. Provide liaison support between the system owner and other information system security personnel. Upload all security control evidence to the Government Risk Compliance (GRC) application to support security control implementation during the monitoring phase. Establish audit trails, ensuring their review and reporting all identified security findings. Make audit reviews available, when required, to the ISSM or Chief Security Officer (CSO). Retain audit logs in accordance with established policy. Integrate audit reviews with Insider Threat programs and monitoring processes. Ensure that selected security controls are implemented and operating as intended during all phases of the information system life cycle. Provide input to the development process which will include Information Security planning, design, test and analysis. Physical Security Manage the review, release and destruction of media and/or memory components. Ensure Information Systems are disposed of in accordance with approved security policies and practices. Conduct security reviews of electronic devices (e.g., portable electronic devices (PEDs), laptops, tables, etc.) prior to and when exiting US government space. Conduct security reviews of media provided by external sources prior to this media being introduced into Information System. Manage thumb drive accountability and Agency incident response process. General Ensure that all users have the requisite security clearances, authorization, and need-to-know before granting access to the IS. Ensure users are aware of their security responsibilities before granting access to an IS Ensure a process for managing changes in user access to ISS (as required access and need-to-know change) and for terminating user access when it is no longer required or authorized, according to established policy requirements. Research and maintain knowledge of Information Assurance (IA) policies and practices, seeking clarification from the ISSM or higher authority when needed, and disseminates these to users. Respond to insider threat requests for analysis pertaining to supported systems. Ensure that changes to an information system, it's environment, and operational needs that may affect the authorization status are reported to the system owner and ISSM. Report all Information System security-related incidents in accordance with the reporting requirements in the system’s IRP and ISCP. Provide research and analysis of Commercial-Off-The-Shelf (COTS) and Government- Off-The-Shelf (GOTS) and IA-enabled products as part of the security architecture and ensure products are National Security Telecommunications and Information Systems Security Policy Number 11 (NSTISSP-11) complaint and validated via the National Information Assurance Partnership (NIAP) Common Criteria Evaluation and Validation Scheme or National Institute of Standard (NIST) Federal Information Processing Standards (FIPS) Cryptographic Module Validation Program (CMV P). Qualifications The following qualifications are desired: Bachelor’s Degree with 7 years of experience Active TS/SCI with Poly Splunk Experience Microsoft Azure and AWS Cloud Experience Education relevant to computer engineering, information security, information management, and/or computer science Any of the following certifications:  CISSP, CASP, CAP, GSLC, CISM Scheduled Weekly Hours: 40 Travel Required: None T elecommuting Options: Telecommuting Not Allowed Work Location: USA VA Chantilly Additional Work Locations: We are GDIT. The people supporting some of the most complex government, defense, and intelligence projects across the country. We deliver. Bringing the expertise needed to understand and advance critical missions. We transform. Shifting the ways clients invest in, integrate, and innovate technology solutions. We ensure today is safe and tomorrow is smarter. We are there. On the ground, beside our clients, in the lab, and everywhere in between. Offering the technology transformations, strategy, and mission services needed to get the job done. GDIT is an Equal Opportunity/Affirmative Action employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, disability, or veteran status, or any other protected class.

Keywords: General Dynamics Information Technology, Chantilly , Information Security- ISSO (Active Top Secret Clearance Required), Other , Chantilly, Virginia