AnaVation

Federal IT engineering services and cybersecurity

Information System Security Officer

Security Governance, Risk & ComplianceConfirmed live in the last 24 hours

Full-timeWashington, DC, USA

About the Job

Requirements

At least 6 years of experience with NIST, FISMA, and Security Assessment & Authorization.
Experience with FedRAMP and cloud environments, such as Azure, AWS, or Oracle Cloud Infrastructure.
Knowledge of relevant NIST security publications, including SP 800-53 Revision 5, SP 800-53A, and SP 800-18 Revision 1.
In-depth knowledge of the Risk Management Framework.
Ability to obtain and maintain a customer Public Trust clearance.
CISSP certification is required.
Familiarity with NIST security control families relevant to assigned evaluations.
Ability to provide subject matter expertise to the project team to ensure compliance with applicable requirements.
Demonstrated knowledge of IT security policy implementation statements, policy regulatory structure, and the roles of the Department of Homeland Security, Office of Management and Budget, and National Institute of Standards and Technology.
Hands-on experience with Governance, Risk, and Compliance tools such as JCAM (CSAM) or eMASS.
Ability to conduct gap analyses of non-federated vendor audit results, including SOC Type 2 and HIPAA comparisons against NIST SP 800-53 Revision 5 security controls.
Hands-on experience providing C-level presentations and reporting.
Strong written communication skills and understanding of the purpose and use of a System Security Plan.
Understanding of control inheritance as applied to Risk Management Framework implementation in the JCAM tool.
Ability to manage complex workstreams and understand application of the Risk Management Framework and security controls across interface, application, operating system, network, and database layers, including applicable compliance evidence.
Experience with security tools for vulnerability management, such as Nessus; configuration management, such as BigFix, SCCM, or ePO; endpoint protection, such as antivirus or advanced threat protection; data loss prevention; and intrusion detection software and hardware.
Ability to evaluate data flows, network diagrams, and logical security boundaries.
Strong oral and written communication skills.
Familiarity with data analysis tools, including Microsoft Excel or Power BI, to combine data from multiple sources.

Responsibilities

Participate in the agency’s risk assessment program, performing internal audits and developing streamlined assessment processes.
Provide technical security expertise for high-priority projects as part of the customer team.
Manage the security of system accreditation boundaries and address enterprise governance and exposure risks across multi-cloud and on-premises environments involving multiple vendors, customers, and XaaS products.
Evaluate the agency’s current system infrastructure and recommend changes to improve its security posture.
Support security compliance and audit liaison activities, focusing on improving security for the agency’s forensic and investigative laboratories.
Develop, maintain, and assess Security Assessment and Authorization packages resulting in an Authority to Operate for IT systems.
Create and maintain System Security Plans and supporting documentation in accordance with agency guidelines and directives, including implementation statements, contingency plans, incident response plans, and account management plans.
Perform self-assessments and peer assessment reviews while working with system stakeholders.
Develop, coordinate, test, and train personnel on incident response and contingency plans.
Ensure information systems are accredited, maintain their Authority to Operate, and undergo continuous monitoring.
Perform risk assessments for agency systems and applications, including cloud-based systems.
Perform security control assessments by collecting supporting artifacts and evidence and interviewing system owners or their representatives.
Maintain and track system Plans of Action and Milestones.
Review and analyze vulnerability scan data and recommend remediation.
Take ownership of various projects.
Improve processes and procedures and recommend changes to strengthen the security posture of the agency’s IT systems and applications.

Desired Qualifications

Familiarity with the NIST security control families covered by documents under evaluation.
Ability to provide subject matter expertise to the project team to ensure compliance with applicable requirements.
Demonstrated knowledge of IT security policy implementation statements, the regulatory structure of policy, and the roles of the Department of Homeland Security, Office of Management and Budget, and National Institute of Standards and Technology.
Hands-on experience with Governance, Risk, and Compliance tools such as JCAM (CSAM) or eMASS.
Ability to conduct gap analyses of non-federated vendor audit results, such as SOC Type 2 and HIPAA comparisons against NIST SP 800-53 Revision 5 controls.
Hands-on experience providing C-level presentations and reporting.
Strong written communication skills and understanding of the purpose and use of a System Security Plan.
Understanding of control inheritance as applied to Risk Management Framework implementation in the JCAM tool.
Ability to manage complex workstreams and understand the application of the Risk Management Framework and security controls across interface, application, operating system, network, and database layers, including applicable compliance evidence.
Experience with security tools for vulnerability management, such as Nessus; configuration management, such as BigFix, SCCM, or ePO; endpoint protection, such as antivirus or advanced threat protection; data loss prevention; and intrusion detection software and hardware.
Ability to evaluate data flows, network diagrams, and logical security boundaries.
Strong oral and written communication skills.
Familiarity with data analysis tools, including Microsoft Excel or Power BI, to combine data from multiple sources.

Salary Range: 85933.19 to 202292.42 (Currency: USD) (Pay period: per-year-salary)

Be Challenged and Make a Difference

In a world of technology, people make the difference. We believe if we invest in great people, then great things will happen. At AnaVation, we provide unmatched value to our customers and employees through innovative solutions and an engaging culture.

Description of Task to be Performed:

AnaVation is seeking a Sr. Security Specialist (ISSO) for our mission critical customer in Washington, DC. You will work as part of a fantastic team providing security expertise on high priority projects. Daily duties include, but are not limited to:

Integral team member for agency’s risk assessment program that will be performing internal audits and building streamlined assessment processes.
Having in-depth security knowledge, is highly technical, and experienced in managing the security of a system's accreditation boundary.
Focusing on the enterprise governance and risk of exposure across a multi-cloud and on-premise environment that will include multiple vendors, customers and XaaS products.
Evaluating agency’s current system infrastructure and recommending changes to improve its security posture.
Providing customer support for security compliance and audit liaison activities. Focus is on improving the security posture of the agency’s Forensic and Investigative Labs.
Developing, maintaining, and assessing Security Assessment & Authorization (SA&A) packages resulting in an Authority to Operate (ATO) for IT systems.
Creating and maintaining SSPs and supporting documentation in accordance with agency guidelines and directives. This includes writing implementation statements, creating supporting documentation (e.g., Contingency Plans, Incident Response Plans, Account Management Plans, etc.), performing self-assessments, and/or assessing your peer’s assessment, while working with system stakeholders.
Develop, coordinate, test, and train personnel on Incident Response Plans and Contingency Plans.
Ensuring that information systems are accredited, maintain their ATO, and are being continuously monitored.
Performing risk assessments for agency systems/applications, to include cloud-based systems.
Performing security control assessments to include collecting supporting artifacts/evidence and interviewing system owner/owner representatives.
Maintaining and tracking system POA&Ms.
Reviewing and analyzing vulnerability scan data and providing recommendations on remediation.
Taking ownership on various projects.
Improving processes and procedures and making recommendations to improve the security posture of the agency's IT systems and applications.

This position is on-site in Washington, DC.

Required Qualifications:

6+ years’ experience with NIST, FISMA, and Security Assessment & Authorization.

FedRAMP and Cloud experience (e.g., Azure, AWS, Oracle (OCI))

Knowledgeable on various security-related NIST publications (e.g., SP 800-53r5, SP 800-53A, SP 800-18r1, etc.)

An in-depth knowledge of the Risk Management Framework (RMF).

Ability to obtain and maintain a customer Public Trust clearance required. Qualified candidates can be sponsored for this clearance.

Certifications: CISSP required

Preferred Qualifications:

Familiarity with the security control families from the NIST guidance covered by the documents that they are responsible for evaluating.

Ability to provide subject matter expert-level knowledge to the project team to ensure compliance with applicable requirements.

Demonstrated knowledge of IT Security policy implementation statements, the regulatory structure of policy, the role of the Department of Homeland Security (DHS), the Office of Management and Budget (OMB), and the National Institute of Standards and Technology (NIST).

Hands-on experience using a Governance, Risk, and Compliance tool, such as JCAM (CSAM) or eMASS.

Ability to conduct gap analysis on non-federated vendor audit results, such as SOC Type 2, HIPAA comparison review and analyze against NIST SP 800-53 Revision 5 security controls.

Hands-on experience providing C-Level presentation and reporting.

Excellent written communication skills and understand the purpose and use of the System Security Plan (SSP).

Possess an understanding of control inheritance as applied to the RMF implementation in the JCAM tool.

Ability to accurately manage complex workstreams, comprehend the application of the RMF, and understand the application of security controls across the interface, application, operating system, network, and database layers of modern information systems. Understand the applicable artifacts used as evidence to assess compliance.

Experience with multiple tools providing security functions such as vulnerability management (e.g., Nessus), configuration management (e.g., BigFix, SCCM, ePO), endpoint protection (e.g., antivirus, ATP), data loss prevention, and intrusion detection software and hardware.

Ability to evaluate data flows, network diagrams, and logical security boundaries.

Excellent oral and written communication skills

Familiarity with the use of data analysis tools, including the use of Microsoft Excel or PowerBI to combine data from multiple sources.

Benefits

Generous cost sharing for medical insurance for the employee and dependents
100% company paid dental insurance for employees and dependents
100% company paid long-term and short-term disability insurance
100% company paid vision insurance for employees and dependents
401k plan with generous match and 100% immediate vesting
Competitive Pay
Generous paid leave and holiday package
Tuition and training reimbursement
Life and AD&D Insurance

About AnaVation

AnaVation is the leader in solving the most complex technical challenges for collection and processing in the U.S. Federal Intelligence Community. We are a US owned company headquartered in Chantilly, Virginia. We deliver groundbreaking research with advanced software and systems engineering that provides an information advantage to contribute to the mission and operational success of our customers. We offer complex challenges, a top-notch work environment, and a world-class, collaborative team.

If you want to grow your career and make a difference while doing it, AnaVation is the perfect fit for you!

AnaVation is an equal opportunity employer. All qualified applicants will receive consideration for employment without regard to sex, race, color, religion, national origin, disability, protected Veteran status, age, or any other characteristic protected by law.

About the Company

AnaVation

Federal IT engineering services and cybersecurity

AnaVation provides IT engineering services to the U.S. Federal Government, focusing on complex technical and analytical challenges. It works by delivering contract-based projects that cover intelligence collection and processing, analytical systems, big data solutions, and cybersecurity, using cross-disciplinary engineering teams (called AnaVators) to tailor solutions to government needs. The company differentiates itself through a government-focused, cost-effective approach, deep technical expertise, and a values-driven culture that emphasizes building long-term partnerships and strong customer trust. Its goal is to help federal agencies improve operational efficiency, security, and decision-making by solving difficult technical problems and delivering reliable, mission-critical software and systems.

Company size: 51-200
Company stage: Not listed
Total funding: Not listed
Headquarters: Reston, VA
Founded: 2013

Recently Posted Jobs

Explore more opportunities at AnaVation

See more jobs