Information System Security Officer II

Reflexive Concepts; Hanover (MD); Presencial; USD 120.000 - 160.000; Jornada completa

Descripción de la vacante

Reflexive Concepts, LLC is seeking a skilled Information System Security Officer II to join our growing team in Hanover, MD. You will own security documentation, accreditation packages, continuous monitoring, and related RMF activities, working closely with the ISSM, DAOs, developers, and system administrators.

Responsibilities include preparing SSPs, incorporating RMF artifacts, maintaining accreditation, and ensuring timely C&A submissions.

Formación

• Ten years of relevant work experience, including at least four years as an ISSO.
• Bachelor's degree in a technical discipline; an additional four years of experience may substitute for the degree.

Responsabilidades

• Prepare the SSP and help obtain ATOs.
• Incorporate RMF artifacts (architecture, boundaries, risk assessments, POA&Ms, data flows).
• Work with ISSM and DAOs to maintain accreditation.
• Verify package submissions meet approval thresholds (C&A, SAR findings, POA&Ms, SSPs).
• Apply continuous monitoring to evaluate security posture.
• Create tasks for developers and sysadmins; oversee patch deployments.
• Enforce information systems security policies and methodologies.
• Use vulnerability tools (ACAS/Nessus) to document compliance.
• Review audit logs weekly.
• Perform weekly data transfers Hanover to Fort Meade.
• Maintain and report assessment and authorization statuses.
• Support PRIVAC requests and extensions.

Conocimientos

Communication skills

Team collaboration

Clear status updates

Educación

Bachelor's degree in technical discipline

14 years total experience alternative to degree

Herramientas

Jira

Redmine

ServiceNow

Descripción del empleo

Reflexive Concepts is seeking a skilled Information System Security Officer II to join our growing team!

Provide security architecture and systems engineering support for ICAM projects, guiding the team through system accreditation (IATT and ATO). You will own security documentation, continuous monitoring, and accreditation packages, working closely with the ISSM, DAOs, developers, and system administrators.

Responsibilities

• Prepare the system security plan (SSP) and provide recommendations to help obtain ATOs
• Identify, develop (directly or in coordination with applicable experts), review, and incorporate common RMF accreditation package artifacts, such as system architecture and boundaries, hardware and software lists, risk assessment reports, POA&Ms, data flows, and other system, network, and application documentation
• Work with the ISSM and DAOs to ensure systems obtain and maintain accreditation
• Verify that package submissions meet the threshold for approval, including C&A packages for system reauthorization, SAR findings, CTOs, POA&Ms, and SSPs
• Apply continuous monitoring techniques to evaluate the system's security posture
• Create tasking for developers and system administrators as changes and patching are required
• Oversee the implementation of software patches to maintain the organization's security posture
• Implement and enforce information systems security policies, standards, and methodologies
• Use vulnerability scanning and assessment tools (e.g., ACAS/Nessus) to identify and document compliance
• Review audit logs weekly
• Perform weekly data transfers, driving from the Hanover office to Fort Meade
• Maintain and report assessment and authorization statuses and issues in accordance with organizational guidance
• Understand the PRIVAC process and support personnel with new PRIVAC requests and extensions

Qualifications

• Ten (10) years of relevant work experience, including at least four (4) years as an ISSO on programs and contracts of similar scope, type, and complexity
• Bachelor's degree in a technical discipline from an accredited college or university
  • An additional four (4) years of experience may be substituted for the degree, for a total of fourteen (14) years

Required

• IAM Level 1 CWIP certification, plus one of the following baseline certifications: CAP, CND, Cloud+, GSLC, Security+ CE, HCISPP, CASP+ CE, CISM, CISSP (or Associate), or CCISO
• Experience with the ICD 503/NIST 800-53 certification and accreditation process
• Experience with the Risk Management Framework (RMF)
• Experience developing and maintaining SSPs
• Experience with IAVA review and handling
• Experience interpreting security scan results
• Experience interfacing with system administrators and software engineers
• Experience with task tracking systems (e.g., Jira, Redmine, ServiceNow)
• Understanding of Public Key Infrastructure (PKI)-based authentication
• Understanding of a variety of security policies, especially within the IC
• Understanding of the fundamentals of technical security risk assessment
• Understanding of how to perform an analysis of alternatives
• Ability to clearly communicate ideas and status updates to management and other stakeholders

Desired Skills

• Must be able to work in a collaborative environment, with minimal supervision