Job details
Salary $125,000 - $135,000 a year job type full-time contract number of hires for this role 10+
Qualifications
High school or equivalent (required)
Rmf: 5 years (required)
Nist standards: 5 years (required)
Cissp (required)
Us work authorization (required)
Certified information systems auditor (preferred)
Full job description
***active cissp required***
Key functions
The information system security officer (isso) is responsible for the cybersecurity of a program, organization, system, or enclaveThe isso ensures that the security and privacy posture is maintained for an organizational system and works in close collaboration with the system ownerThe isso serves as a principal advisor on all matters, technical and otherwise, involving the security and privacy controls for the system and has the knowledge and expertise to manage the security and privacy aspects of an organizational system.
Selected responsibilities
IIdentify the security and privacy requirements allocated to a system and to the organization.
IiIdentify the characteristics of a system.
IiiContribute to determining the boundary of a system.
IvCollaborate with the system owner to categorize the system and document the security categorization results as part of system requirements.
VIdentify stakeholders who have a security and/or privacy interest in the development, implementation, operation, or sustainment of a system.
ViIdentify the stakeholder protection needs and stakeholder security and privacy requirements.
ViiIdentify the types of information to be processed, stored, or transmitted by a system.
ViiiIdentify stakeholder assets that require protection.
IxConduct an initial risk assessment of stakeholder assets and update the risk assessment on an ongoing basis.
XSelect the security and privacy controls for a system and document the functional description of the planned control implementations in a security/privacy plan.
XiDevelop a strategy for monitoring security and privacy control effectiveness; coordinate the system-level strategy with the organization and mission/business process-level monitoring strategy.
XiiDevelop, review, and approve a plan to assess the security and privacy controls in a system and the organization.
XiiiDocument changes to planned security and privacy control implementation and establish the configuration baseline for a system.
XivRespond to system risk posture based on the results of ongoing monitoring activities, assessment of risk, and outstanding items in a plan of action and milestones (poa&m).
XvPrepare a plan of action and milestones based on the findings and recommendations of a security assessment report excluding any remediation actions taken.
XviUpdate a security plan, security assessment report, and plan of action and milestones based on the results of a continuous monitoring process.
XviiReview the security and privacy status of a system (including the effectiveness of security and privacy controls) on an ongoing basis to determine whether the risk remains acceptable.
XviiiReport the security status of a system (including the effectiveness of security and privacy controls) to an authorizing official on an ongoing basis in accordance with the monitoring strategy.
XixEnsure that plans of actions and milestones or remediation plans are in place for vulnerabilities identified during risk assessments, audits, inspections, etc.
XxEnsure that security improvement actions are evaluated, validated, and implemented as required.
Qualifications
Skills
ISkill in creating policies that reflect system security and privacy objectives.
IiSkill in applying confidentiality, integrity, and availability principles.
IiiSkill in assessing security and privacy controls based on cybersecurity and privacy related principles and tenets(e.g., cis csc, nist sp 800-53, cybersecurity framework, etc.).
IvSkill to apply cybersecurity and privacy principles to organizational requirements (relevant to confidentiality, integrity, availability, authentication, non-repudiation).
VSkill in determining how a security system should work (including its resilience and dependability capabilities) and how changes in conditions, operations, or the environment will affect the security and privacy of the system
ViSkill in technical writing.
ViiSkill in writing about facts and ideas in a clear, convincing, and organized manner.
ViiiSkill in evaluating the trustworthiness of the supplier and/or product.
Required abilities
IAbility to answer questions in a clear and concise manner.
IiAbility to ask clarifying questions.
IiiAbility to communicate complex information, concepts, or ideas in a confident and well-organized manner through verbal, written, and/or visual means.
IvAbility to communicate effectively when writing.
VAbility to prepare and present briefings.
ViAbility to produce technical documentation.
ViiAbility to design valid and reliable assessments.
ViiiAbility to operate common network tools (e.g., ping, traceroute, nslookup).
IxAbility to operate different electronic communication systems and methods (e.g., e-mail, voip, im, web forums, direct video broadcasts).
XAbility to apply critical reading/thinking skills.
XiAbility to evaluate information for reliability, validity, and relevance.
XiiAbility to function in a collaborative environment, seeking continuous consultation with other analysts and experts—both internal and external to the organization—to leverage analytical and technical expertise.
XiiiAbility to think critically.
XivAbility to monitor advancements in information privacy technologies to ensure organizational adaptation and compliance.
XvAbility to understand technology, management, and leadership issues related to organization processes and problem solving.
XviAbility to apply techniques for detecting host and network-based intrusions using intrusion detection technologies.
XviiAbility to integrate information security requirements into the acquisition process; using applicable baseline security controls as one of the sources for security requirements; ensuring a robust software quality control process; and establishing multiple sources (e.g., delivery routes, for critical system elements).
XviiiAbility to identify critical infrastructure systems with information communication technology that were designed without system security considerations.
Required knowledge
IKnowledge of an organization`s information classification program and procedures for information compromise.
IiKnowledge of applicable laws, statutes (e.g., in titles 10, 18, 32, 50 in u.sCode), presidential directives, executive branch guidelines, and/or administrative/criminal legal guidelines and procedures.
IiiKnowledge of application security risks (e.gOpen web application security project top 10 list)
IvKnowledge of authentication, authorization, and access control methods.
VKnowledge of computer algorithms.
ViKnowledge of controls related to the use, processing, storage, and transmission of data.
ViiKnowledge of critical information technology (it) procurement requirements.
ViiiKnowledge of critical infrastructure systems with information communication technology that were designed without system security considerations.
IxKnowledge of current and emerging threats/threat vectors.
XKnowledge of current industry methods for evaluating, implementing, and disseminating information technology (it) security assessment, monitoring, detection, and remediation tools and procedures utilizing standards-based concepts and capabilities.
XiKnowledge of cyber defense and information security policies, procedures, and regulations.
XiiKnowledge of cyber defense and vulnerability assessment tools and their capabilities.
XiiiKnowledge of enterprise incident response program, roles, and responsibilities.
XivKnowledge of how traffic flows across the network (e.g., transmission control protocol [tcp] and internet protocol [ip], open system interconnection model [osi], information technology infrastructure library, current version [itil]).
XvKnowledge of incident categories, incident responses, and timelines for responses.
XviKnowledge of incident response and handling methodologies.
XviiKnowledge of industry-standard and organizationally accepted analysis principles and methods.
XviiiKnowledge of information security program management and project management principles and techniques.
XixKnowledge of intrusion detection methodologies and techniques for detecting host and network-based intrusions.
XxKnowledge of laws, policies, procedures, or governance relevant to cybersecurity for critical infrastructures.
XxiKnowledge of measures or indicators of system performance and availability.
XxiiKnowledge of network protocols such as tcp/ip, dynamic host configuration, domain name system (dns), and directory services.
XxiiiKnowledge of network security architecture concepts including topology, protocols, components, and principles (e.g., application of defense-in-depth).
XxivKnowledge of network systems management principles, models, methods (e.g., end-to-end systems performance monitoring), and tools.
XxvKnowledge of network traffic analysis methods.
XxviKnowledge of new and emerging information technology (it) and cybersecurity technologies.
XxviiKnowledge of organization`s risk tolerance and/or risk management approach.
XxviiiKnowledge of payment card industry (pci) data security standards.
XxixKnowledge of penetration testing principles, tools, and techniques.
XxxKnowledge of personally identifiable information (pii) data security standards.
XxxiKnowledge of resource management principles and techniques.
XxxiiKnowledge of server administration and systems engineering theories, concepts, and methods.
XxxiiiKnowledge of server and client operating systems.
XxxivKnowledge of system administration, network, and operating system hardening techniques.
XxxvKnowledge of system and application security threats and vulnerabilities (e.g., buffer overflow, mobile code, cross-site scripting, procedural language/structured query language [pl/sql] and injections, race conditions, covert channel, replay, return-oriented attacks, malicious code).
XxxviKnowledge of system life cycle management principles, including software security and usability.
XxxviiKnowledge of system software and organizational design standards, policies, and authorized approaches (e.g., international organization for standardization [iso] guidelines) relating to system design.
XxxviiiKnowledge of technology integration processes.
XxxixKnowledge of the organization’s enterprise information technology (it) goals and objectives.
Requirements, preferred experience and certifications
U.sCitizenship
This requires 7+ years of relevant cyber security experience and is a senior position.
Required certifications
Certified information systems security professional (cissp)
Relevant certifications
Comptia advanced security practitioner (casp)
Giac certified penetration tester (gpen)
Giac continuous monitoring certification (gmon)
Giac information security professional (gisp)
Giac security essentials certification (gsec)
Giac security leadership certification (gslc)
Certified information security manager (cism)
Certified information systems auditor (cisa)
Certified authorization professional (cap)
Certified cloud security professional (ccsp)
Systems security certified practitioner (sscp)
Cissp information systems security management professional (cissp-issmp)
Job types: full-time, contract
Pay: $125,000.00 - $135,000.00 per year
Schedule:
8 hour shift
Education:
High school or equivalent (required)
Experience:
Rmf: 5 years (required)
Nist standards: 5 years (required)
Isso: 5 years (required)
License/certification:
Cissp (required)
Certified information systems auditor (preferred)
Work location:
Fully remote
Work location: remote
