Information Security Analyst

Abacus Solutions Group, LLC; San Antonio (TX); On-site; USD 90,000 - 120,000; Full time

Job summary

Abacus Solutions Group, LLC is seeking a cybersecurity professional to ensure the safety of information systems by applying RMF and NIST standards. You will coordinate authorization activities, conduct risk assessments, and monitor security controls across systems, networks, and databases.

A BA/BS and industry certifications are required, with strong focus on CISA, CISM, CISSP, or CAP. You will work with IT teams and management to maintain security compliance, perform vulnerability assessments,

Qualifications

• Must have strong Certification & Authorization foundation.
• Solid working knowledge of RMF and NIST publications.
• Experience coordinating security assessments and authorization activities.

Responsibilities

• Develop and coordinate all authorization documentation (System Categorization, System Security Plan, risk assessment).
• Support control assessment, reporting and monitoring processes.
• Coordinate DoS liaison to provide POA&M status.
• Assist in remediation and ensure POA&Ms are managed.
• Update Business Continuity and Contingency planning.
• Conduct vulnerability scanning and provide reports and metrics.
• Review SA&A documentation and security infrastructure.
• Assess NIST 800-53 controls and document results.
• Perform risk assessments and develop POA&Ms from weaknesses.
• Monitor IDS for security issues and remediation.

Skills

Certification & Authorization

RMF

NIST guidance

Education

BA/BS or equivalent

Job description

Job Profile Summary

Performs all procedures necessary to ensure the safety of information systems assets and to protect systems from intentional or inadvertent access or destruction. Monitor, evaluate, and maintain systems and procedures to safeguard internal information systems, network, databases, and Web-based security. A successful candidate will have a strong foundation in Certification and Authorization activities, along with a good working knowledge of the Risk Management Framework (RMF) and NIST publications related to cybersecurity. They will work with both the IT teams and management to maintain security compliance throughout the organization.

Responsibilities

• Develop and coordinate all authorization documentation associated including the Systems Categorization, Systems Security Plan, and Systems risk assessment
• Support the control assessment, reporting and monitoring processes
• Coordinate DoS liaison to provide POA&M status
• Support and document Security Control Assessments, assist in remediation and ensure that POA&Ms are being appropriately managed.
• Update Business Continuity and Contingency Plan for the component.
• Conduct vulnerability scanning of IT systems and provide reports and metrics
• Assist the components with decisions that affect security of their systems and networks.
• Conduct assessments of information systems security requirements, evaluate current security posture and recommend priorities for remediation.
• Review information system infrastructure and application architecture to assess security requirements
• Review existing SA&A documentation, Security Assessment Report and security infrastructure (i.e. IDS, firewalls, vulnerability scan tools, etc.)
• Assess NIST 800-53, Rev 4/Rev 5 Control and document results
• Evaluate and strengthen standard SA&A Documentation, work with the customer to maintain the system ATO
• Perform and document risk assessments, analyzing security vulnerabilities, and the metrics to measure the risks associated with those vulnerabilities;
• Review and conduct annual NIST-based Self Assessments, identifying any weaknesses which need to be addressed, and developing a POA&M for each of those weaknesses based on industry best practices.
• Monitors and analyzes Intrusion Detection Systems (IDS) to identify security issues for remediation
• Recognizes potential, successful, and unsuccessful intrusion attempts and compromises thorough reviews and analyses of relevant event detail and summary information
• Evaluates technology change requests and assesses organizational risk
• Assists with implementation of countermeasures or mitigating controls
• Researches, evaluates, tests, and implements new security software or devices
• Conducts investigations of information systems security violations and incidents, reporting as necessary to management
• Implements, enforces, communicates, and develops security policies or plans for data, software applications, hardware, telecommunications, and information systems security education/awareness programs
• Performs periodic and on-demand system audits and vulnerability assessments, including user accounts, application access, file system and external Web integrity scans to determine compliance
• Provides information to management regarding the negative impact on the business caused by theft, destruction, alteration, or denial of access to information
• Ensure compliance with regulations and privacy laws
• Develops materials for computer security education/awareness programs
• Responds to queries and requests for computer security information and reports
• May serve as a team or task lead

Education:

BA/BS or equivalent from an accredited university is required.

Must one more of the following certifications:

• ISACA - Certified Information Systems Auditor (CISA)
• ISACA - Certified Information Security Manager (CISM)
• (ISC)2 - Certified Information Systems Security Professional (CISSP)
• (ISC)2 - Certified Authorization Professional (CAP)