[Hiring] Information Systems Security Officer @Sparibis

Role Description

100% remote.

Ability to independently lead, manage, and execute the complete RMF lifecycle for assigned information systems, from system categorization and security control selection through implementation, assessment, authorization, and continuous monitoring, to obtain and maintain an Authority to Operate (ATO).

• Coordinate RMF activities with U.S. Navy customers, government stakeholders, system owners, engineering teams, and other program personnel to ensure security requirements are implemented and authorization milestones are achieved.
• Develop, manage, maintain, and support comprehensive RMF documentation packages including System Security Plans (SSPs), security control implementation statements, Security Assessment Reports (SARs), Plans of Action and Milestones (POA&Ms), and supporting security assessment evidence.
• Manage and maintain RMF authorization documentation, security control assessments, compliance information, and authorization package records within the Enterprise Mission Assurance Support Service (eMASS), ensuring documentation and security control implementation evidence are accurate and current.
• Interpret and apply applicable Cybersecurity Control Security Requirements Guides (CCSRGs) to assess system security requirements, validate security control implementation, identify compliance gaps, and support RMF authorization and continuous monitoring activities.
• Interpret, assess, and apply NIST SP 800-53 security controls and applicable government cybersecurity requirements to custom on-premises and AWS cloud environments, identifying control gaps and coordinating implementation and remediation activities.
• Conduct and coordinate vulnerability management activities, including ACAS scanning, vulnerability analysis, Security Technical Implementation Guides (STIGs) reviews, and tracking remediation through VRAM and other applicable tools and processes.
• Perform continuous monitoring of activities, including monthly security reporting, vulnerability scan analysis, security control reviews, account and access reviews, configuration changes, and tracking of corrective actions to maintain an effective security posture.
• Develop, coordinate, and execute security assessment and testing plans to evaluate system security requirements, assess the implementation and effectiveness of security controls, identify vulnerabilities and deficiencies, and document assessment results and supporting evidence required for RMF authorization package submission and approval.
• Identify, document, assess, and communicate cybersecurity risks and deficiencies.
• Coordinate directly with program stakeholders to gather, document, and translate business requirements, facilitate stakeholder and team meetings, provide security reports, and track security work through completion.
• Assist the customer in preparing training and tabletop exercises for contingency planning, incident response and disaster recovery.

Qualifications

• Must have 5+ years of professional experience in Cybersecurity.
• Demonstrated experience serving as an ISSO or in a comparable cybersecurity role with direct responsibility for independently managing system security authorization, RMF compliance, and ongoing security operations within a federal government environment.
• Must be able to obtain and maintain a Secret security clearance.
• Must have a Bachelor’s Degree in a Cybersecurity or IT related field.
• Cybersecurity related certification preferred.
• Demonstrated experience independently leading and executing the complete RMF lifecycle for IATT/ATO activities involving custom on-prem and cloud solutions.
• Experience preparing, maintaining, and managing comprehensive RMF authorization documentation packages, including SSPs, SARs, POA&Ms, Security Assessment Reports, and supporting assessment evidence.
• Must have strong working knowledge and professional experience applying NIST SP 800-53 security controls and applicable federal cybersecurity requirements within the RMF.
• Experience with vulnerability management tools and processes, including ACAS scanning and vulnerability tracking through VRAM.
• Professional experience reviewing, interpreting, and implementing STIGs and assessing system compliance with applicable security configuration requirements.
• Must have demonstrated professional experience using eMASS to develop, manage, update, and maintain RMF authorization documentation, security control assessments, compliance records, and supporting evidence.
• Must have demonstrated professional experience interpreting and applying applicable CCSRG requirements to assess system security controls, validate compliance, identify deficiencies, and support authorization activities.
• Experience evaluating applications, infrastructure, database, and API security, including familiarity with API-based security mechanisms and the OWASP framework for web application vulnerabilities.
• Strong understanding of AWS cloud environments, architecture, and security services, including experience assessing and implementing security controls within cloud-based environments.
• Experience conducting continuous monitoring, analyzing vulnerability scan results, preparing security status reports, and maintaining ongoing system security compliance.
• Experience using cybersecurity tools or scanners to evaluate system security posture, including scanning or reporting for web applications, databases, containers, or other system components.
• Experience assessing security control deficiencies, evaluating cybersecurity risks, documenting findings, developing remediation plans, and tracking corrective actions through resolution.
• Strong communication and organizational skills, with the ability to independently manage multiple RMF activities, coordinate with government customers and technical stakeholders, communicate security risks, and drive deliverables through completion.
• Experience with requirements analysis, security architecture and design, translating cybersecurity requirements into technical security controls, and coordinating implementation with engineering and technical teams.
• Experience gathering and creating security requirements, coordinating with stakeholders, facilitating meetings, and tracking security work through completion.
• Working knowledge of Agile and DevSecOps practices and cybersecurity, network, systems, and software engineering principles.
• Familiarity with Atlassian tools, such as Jira, Confluence, and/or Splunk.

Requirements

• 5+ years professional experience in a cybersecurity related field.
• Bachelor’s degree in IT related field.
• Applicants must be able to obtain and maintain a secret security clearance.
• United States Citizenship is required as part of the eligibility criteria to be able to obtain this type of security clearance.

Benefits

• Equal opportunity employer that values diversity at all levels.
• All individuals, regardless of personal characteristics, are encouraged to apply.