Security Governance, Risk & Compliance·Confirmed live in the last 24 hours·
Full-timePhiladelphia, PA, USANo salary listed
About the Job
Requirements
A bachelor's degree in computer science, information technology, or an equivalent STEM degree from an accredited college or university.
Seven years of professional experience capturing and refining information security operational and security requirements and ensuring they are addressed through purposeful development, configuration, security control implementation, configuration changes, software and hardware updates and patches, vulnerability scanning, and secure configurations.
An IAT-III certification: CASP+ CE, CCNP Security, CISA, CISSP or CISSP Associate, GCED, GCIH, or CCSP.
Responsibilities
Assist with developing, maintaining, and tracking Risk Management Framework (RMF) system security plans and their supporting materials, including System Categorization Forms, Platform Information Technology (PIT) Determination Checklists, Assess Only (AO) Determination Checklists, Implementation Plans, System Level Continuous Monitoring (SLCM) Strategies, System Level Policies, hardware and software lists, system diagrams, Privacy Impact Assessments (PIAs), and Plans of Action and Milestones (POA&Ms).
Execute the RMF process to obtain and maintain Interim Authority to Test (IATT), AO approval, Authorization to Operate (ATO), and Denial of Authorization to Operate (DATO). Identify and tailor information technology and cybersecurity control baselines based on RMF guidelines and categorization of the RMF boundary.
Perform Ports, Protocols, and Services Management (PPSM) and information technology and cybersecurity vulnerability-level risk assessments.
Execute security control testing as required by risk assessments or annual security reviews. Mitigate and remediate system-level vulnerabilities for all boundary assets according to Security Technical Implementation Guide (STIG) requirements, and maintain POA&Ms in Enterprise Mission Assurance Support Service (eMASS).
Develop and maintain system-level information technology and cybersecurity policies and procedures for respective RMF boundaries according to guidance from command Information System Security Managers (ISSMs). Implement and assess STIGs and Security Requirements Guides (SRGs).
Perform and develop vulnerability assessments using automated tools such as Assured Compliance Assessment Solution (ACAS), Security Content Automation Protocol (SCAP) Compliance Check (SCC), and Ev STIG.
Deploy security updates to information system components.
Perform routine audits of information technology system hardware and software components and maintain an inventory of information system components.
Participate in information technology change-control and configuration-management processes.
Upload vulnerability data in Vulnerability Remediation Asset Manager (VRAM). Image or re-image assets within the assigned RMF boundary.
Install software and troubleshoot software issues to support compliance of assets within RMF boundaries.
Assist with removing solid-state drives (SSDs), hard disk drives (HDDs), or other critical asset components before destruction and removal from the RMF boundary.
Provide cybersecurity patching of assets in response to Department of Defense (DoD) and Department of the Navy (DoN) task orders (TASKORDs), fragmentary orders (FRAGORDs), or as required by the command ISSM, Assistant Chief Information Officer (ACIO), or Code 104 management.
Support configuration-change documentation and control processes and maintain DoD STIG compliance.
Support cybersecurity compliance of assets on an enterprise information technology network, including Windows servers and Cisco networking hardware, by assessing vulnerabilities, applying patches, and meeting hardware STIG requirements.
Report network hardware compliance issues to management to help avoid operational loss of the network.
Job Title: Information System Security Engineer (ISSE) III
Location: Philadelphia, PA
Clearance: Secret
Company/ Program Description:
Centuria, a Service-Disabled Veteran-Owned Small Business (SDVOSB), has been delivering IT, Engineering, and Scientific solutions to the Federal Government since 2002. During our two decades of service, we have earned the trust and respect of our government clients for the simple reason that we have great people who are experts in their fields and take pride and ownership in everything they do.
Job Responsibilities:
•Assist with the developing, maintaining, and tracking Risk Management Framework (RMF) system security plans, which include System Categorization Forms, Platform Information Technology (PIT) Determina Checklists, Assess Only (AO) Determination Checklists, Implementation Plans, System Level Continuous Monitoring (SLCM) Strategies, System Level Policies, Hardware Lists, Software List, System Diagram Privacy Impact Assessments (PIA), and Plans of Action and Milestones (POA&M).
•Execute the RMF process in support of obtaining and maintaining Interim Authority to Test (IATT), AO approval, Authorization to Operate (ATO), and Denial of Authorization to Operate (DATO). Identify and tailor IT and Cyber Security (CS) control baselines based on RMF guidelines and categorization of the RMF boundary.
•Perform Ports, Protocols, and Services Management (PPSM). Perform IT and CS vulnerability-level risk assessments.
•Execute security control testing as required by a risk assessment or annual security review (ASR). Mitigate and remediate IT and CS system level vulnerabilities for all assets within the boundary per STIG requirements. Develop and maintain Plans of Actions and Milestones (POA&M) in Enterprise Mission Assurance Support Service (eMASS).
•Develop and maintain system level IT and CS policies and procedures for respective RMF boundaries in accordance with guidance provided by the command ISSMs. Implement and assess STIG and SRGs.
•Perform and develop vulnerability assessments with automated tools such as Assured Compliance Assessment Solution (ACAS), Security Content Automation Protocol (SCAP) Compliance Check (SCC) and Ev STIG.
•Deploy security updates to Information System components.
•Perform routine audits of IT system hardware and software components. Maintain inventory of Information System components.
•Participate in IT change control and configuration management processes.
• Upload vulnerability data in Vulnerability Remediation Asset Manager (VRAM). Image or re-image assets that are part of the assigned RMF boundary.
•Install software and troubleshoot software issues as necessary to support compliance of the RMF boundaries’ assets.
•Assist with removal of Solid-State Drive (SSD), Hard Disk Drive (HDD) or other critical components of assets before destruction and removal from the RMF boundary.
•Provide cybersecurity patching of assets in response to DoD and DoN TASKORDs, FRAGORDs, or as required by Command ISSM, ACIO, and/or Code 104 management.
•Support configuration change documentation and control processes and maintaining DOD STIG Compliance.
•Support cyber compliance of assets that are part of an enterprise IT network to include Windows server and CISCO networking hardware. This includes assessing vulnerabilities, patching and meeting requirements the STIG for the hardware.
•Report compliance issues of network hardware to management to avoid operational loss of the network.
Job Requirements:
•Education: Bachelor’s degree in computer science, information technology, or an equivalent STEM l degree from an accredited college or university.
•Experience: Seven (7) years professional experience capturing and refining information security operational and security requirements and ensuring those requirements are properly addressed through purposeful development, and configuration, and implementing security controls, configuration changes, software/hardware updates/patches, vulnerability scanning, and securing configurations.