Information System Security Engineer (ISSE) II - Hybrid

Ishpi Information Technologies, Inc; Philadelphia (Philadelphia County); On-site; USD 90,000 - 140,000; Full time

Job summary

Ishpi Information Technologies, Inc. seeks an ISSE II to support the Naval Surface Warfare Command in Philadelphia, focusing on RMF-based information security engineering, A&A, vulnerability management, and security control implementation. The role involves planning, testing, and maintaining security artifacts across RMF boundaries.

Qualified candidates will have a bachelor’s degree, 3+ years in info security, and an active U.S. government clearance.

Qualifications

• Three (3) years of professional information security experience across RMF, A&A, and security controls.
• Experience implementing and assessing IT/CS security controls and vulnerability management.
• Active government security clearance and eligibility to access DoD/Navy information.

Responsibilities

• Assessment & Authorization (A&A)
• Cybersecurity Compliance and Audit Readiness
• Information Assurance Vulnerability Management (IAVM)
• Vulnerability Scanning and Remediation
• Application and Implementation of STIGs/SRGs
• Develop and maintain RMF system security plans and artifacts
• Execute RMF processes to obtain/maintain ATO/DATO
• Identify and tailor IT/CS security baselines per RMF
• Perform PPSM and vulnerability risk assessments
• Execute security control testing and remediation
• Maintain and update POA&Ms in eMASS
• Develop IT/CS policies for RMF boundaries
• Implement and assess STIG/SRG compliance
• Vulnerability assessments with ACAS/SCAP/Evaluate STIG tools
• Deploy security updates and perform routine IT audits
• Maintain asset inventories and support change control
• Document and control configuration management
• Upload vulnerability data to VRAM
• Image/re-image assets within RMF boundaries
• Assist with asset removal/destruction per security requirements
• Provide patching during DoD/DoN TASKORDs/FRAGORDs
• Support network security compliance and STIG requirements
• Report compliance issues to management to avoid network impairment

Education

Bachelor’s degree in Computer science, Information Technology, or an equivalent technical degree

Job description

Overview

Ishpi Information Technologies, Inc. (DBA ISHPI) is passionate about providing our customers with technical solutions that satisfy their business needs. Through collaborative interactions with customers, team members, subject matter experts (SMEs), technical leaders, and partners we design practical solutions that solve real problems for major government and business organizations. As a member of our group, you will work with a team focused on delivering innovative business solutions using emerging technologies through proven successful methods.

Responsibilities

The ISSE II will provide support to the Naval Surface Warfare Command in Philadelphia, PA. Shall provide cybersecurity support for the Code 104 Information Technology Operations Division in the area of Information System Security Engineer (ISSE) support. These duties include but are not limited to:

• Assessment & Authorization (A&A)
• Cybersecurity Compliance and Audit Readiness
• Information Assurance Vulnerability Management (IAVM)
• Vulnerability Scanning and Remediation
• Application and Implementation of Security Technical Implementation Guides (STIGs) and Security Requirements Guide (SRGs)

Shall assist with the developing, maintaining, and tracking Risk Management Framework (RMF) system security plans which include System Categorization Forms, Platform Information Technology (PIT) Determination Checklists, Assess Only (AO) Determination Checklists, Implementation Plans, System Level Continuous Monitoring (SLCM) Strategies, System Level Policies, Hardware Lists, Software List, System Diagrams, Privacy Impact Assessments (PIA), and Plans of Action and Milestones (POA&M).

• Execute the RMF process in support of obtaining and maintaining Interim Authority to Test (IATT), AO approval, Authorization to Operate (ATO), and Denial of Authorization to Operate (DATO).
• Identify and tailor IT and CS security control baselines based on RMF guidelines and categorization of the RMF boundary
• Perform Ports, Protocols, and Services Management (PPSM).
• Perform IT and CS vulnerability-level risk assessments.
• Execute security control testing as required by a risk assessment or annual security review (ASR).
• Mitigate and remediate IT and CS system level vulnerabilities for all assets withing the boundary per STIG requirements
• Develop and maintain Plans of Actions and Milestones (POA&M) in Enterprise Mission Assurance Support Service (eMASS).
• Develop and maintain system level IT and CS policies and procedures for respective RMF boundaries and/or guidance provided by the command ISSMs
• Implement and assess STIG and SRGs.
• Perform and develop vulnerability assessments with automated tools such as Assured Compliance Assessment Solution (ACAS), Security Content Automation Protocol (SCAP) Compliance Check (SCC) and Evaluate STIG.
• Deploy security updates to Information System components.
• Perform routine audits of IT system hardware and software components.
• Maintain inventory of Information System components.
• Participate in IT change control and configuration management processes.
• Upload vulnerability data in Vulnerability Remediation Asset Manager (VRAM).
• Image or re-image assets that are part of the assigned RMF boundary
• Install software and troubleshoot software issues as necessary to support compliance of the RMF boundaries’ assets.
• Assist with removal of SSD, HDD or other critical components of assets before destruction and removal from the RMF boundary.
• Provide cybersecurity patching of assets in times of DoD and DoN TASKORDs, FRAGORDs, or even designated by Command ISSM, ACIO, and/or Code 104 management.
• Support configuration change documentation and control processes and maintaining DOD STIG Compliance.
• Support cyber compliance of assets that are part of an enterprise IT network to include Windows server and CISCO networking hardware. This includes assessing vulnerabilities, patching and meeting requirements of the STIG for the hardware.
• Report compliance issues of network hardware to management as not cause an operational of the network.

Qualifications

Education: Bachelor’s degree in Computer science, Information Technology, or an equivalent technical degree from an accredited college or university.

Experience:Three (3) years professional experience capturing and refining information security operational and security requirements, and ensuring those requirements are properly addressed through purposeful architecting, design, development, and configuration; and implementing security controls, configuration changes, software/hardware updates/patches, vulnerability scanning, and securing configurations.

Minimum Certification Requirement includes one of the following:

CCNA-Security

CySA+

GICSP

GSEC or

Security+ CE

Security Clearance: Requires U.S. Citizenship and an active government security clearance.

“Ishpi Information Technologies, Inc. is an Equal Opportunity Employer. All qualified candidates will be considered without regard to legally protected characteristics.

Expression of Interest:By applying to this job, you are expressing interest in this position and could be considered for other career opportunities where similar skills and requirements have been identified as a match. Should this match be identified, you may be contacted for this and future openings.