[Hiring] Information System Security Officer @Chenega Corporation

Role Description

The Information System Security Officer (ISSO) supports the Department of Health and Human Services, Administration for Community Living, Enterprise IT Services Program. Reporting to the Program Manager, the ISSO maintains system security and privacy documentation, coordinates assessments and authorization activities, tracks risks and remediation, and prepares assigned cybersecurity deliverables. The ISSO works with system owners, technical teams, assessors, privacy personnel, and government security officials to support FISMA compliance and the NIST Risk Management Framework.

Responsibilities

• Security governance and posture:
  • Support compliance with FISMA, NIST security controls, RMF, and applicable HHS/ACL requirements.
  • Prepare or coordinate the Technical Cybersecurity Posture Report and Cyber Security Playbook.
  • Support quarterly and annual FISMA reporting as required.
• Assessment and authorization:
  • Coordinate annual Security Assessment and Authorization activities.
  • Compile evidence, support assessors, track findings, and submit packages for government review.
• Security documentation:
  • Update system security plans, configuration management plans, and other system documentation annually.
  • Coordinate annual updates to ACL Information Security and Privacy Policy.
• Assessment reporting:
  • Prepare or coordinate the Risk Assessment Report and Security Assessment Report.
  • Ensure findings are traceable to evidence and corrective actions.
• Risk and remediation:
  • Maintain risk and issue records and track remediation owners.
  • Prepare the monthly Plan of Action and Milestones Report.
• Continuous monitoring and vulnerabilities:
  • Review vulnerability scans and monitoring results.
  • Prepare monthly vulnerability reports.
• Contingency planning:
  • Maintain contingency planning documentation and coordinate annual Contingency Plan Test.
• Incident response:
  • Maintain the ACL Cybersecurity Incident Response Plan.
  • Coordinate security incident reporting and response documentation.
• Security and privacy awareness:
  • Develop and support ongoing phishing scenarios and educational materials.
• Identity and architecture coordination:
  • Review security aspects of identity and access activities.
• Program reporting and records:
  • Maintain assigned security documentation in OneDrive.
  • Participate in biweekly status meetings and provide security inputs.
• Transition and technical support:
  • Support security knowledge transfer and documentation handover.
• Perform other related duties as assigned.

Qualifications

• Bachelor’s degree in information technology or cybersecurity, or additional experience in lieu of a degree.
• 5+ years of experience in cybersecurity, information assurance, or a related field, preferably within a federal environment.
• Certified Information Systems Security Professional, or equivalent experience.
• Public Trust background investigation is required.

Preferred Qualifications

• 5+ years of experience in security architecture, security assessment, or a related cybersecurity role in a federal or government environment.
• Certified Information Security Manager or Certified Information Systems Auditor.
• Employment screening: Successfully pass background and drug screening.

Knowledge, Skills and Abilities

• Experience with FISMA, NIST RMF, security control assessments, and FedRAMP controls.
• Ability to develop and maintain security authorization packages and system security documentation.
• Ability to translate assessment and vulnerability findings into documented risks and remediation actions.
• Proficiency with vulnerability scanners and security information systems.
• Working knowledge of continuous monitoring, identity and access management, and incident response.
• Ability to coordinate assessments and deliver security awareness materials.

Benefits

• Broad range of benefits offered to team members.
• Opportunities for professional development and skill sharpening.
• Supportive culture that encourages team members to do their best work.