Information Systems Security Analyst

EIGENNET LLC; United States; On-site; USD 90,000 - 130,000; Full time

Benefits offered by this job

On-site work

Job summary

EIGENNET LLC is seeking an Information Systems Security Engineer (ISSE) to support NAVFAC Marianas CIO3 Office on-site in Guam. You will perform RMF-based cybersecurity engineering for Facility-Related Control Systems, ensuring confidentiality, integrity, and availability of government networks and data.

The role requires DoN/DoD RMF experience, NIST SP 800-53 controls, eMASS management, vulnerability assessments, and STIG/SRG compliance across FRCS environments.

Qualifications

• Experience supporting DoN/DoD cybersecurity environments with RMF, NIST SP 800-53 and eMASS.
• Ability to develop and maintain RMF artifacts, SSPs, and related documentation.
• Proficient with vulnerability management and STIG/SRG compliance.

Responsibilities

• Execute RMF lifecycle activities (Steps 1-6) per DoN/DoD NAVFAC guidance.
• Review and validate system inventories, security documentation, and authorization artifacts.
• Support ATO activities, package maintenance, and annual security reviews.
• Develop cybersecurity documentation including SSPs, policies, SOPs, and plans.
• Apply NIST SP 800-53 controls and tailor requirements for FRCS environments.
• Develop and execute vulnerability management strategies using DoD/Navy processes.
• Perform vulnerability assessments with ACAS/Nessus, SCAP, and related tools.
• Validate STIG/SRG compliance using .ckl and .cklb formats.
• Generate cybersecurity assessment reports and maintain vulnerability documentation.

Skills

RMF lifecycle

NIST SP 800-53

eMASS

STIG

POA&M

CCB

CERT

ACAS/Nessus

SCAP

Security Center

VRAM

Tools

ACAS/Nessus

SCAP

Security Center

VRAM

Job description

Job Description

Job Title: Information Systems Security Engineer (ISSE) - Systems Security Analyst

Employment Type: Full-Time - Up to 40 hours per week

Employment Status: Contingent Upon Contract Award

Customer Agency: Naval Facilities Engineering Systems Command (NAVFAC) Marianas - Command Information Office (CIO3 Office)

Work Location: On-Site

Place of Performance:

• Naval Facilities Engineering Systems Command (NAVFAC) Marianas facilities:
  • Building 205, Halsey Drive, Nimitz Hill, Piti, Guam 96915.
  • Building 3179, Sumay Drive, Naval Base Guam, Santa Rita, Guam 96915.
• Additional Government facilities as required:
  • Marine Corps Base Camp Blaz, Guam.
  • Andersen Air Force Base, Guam.

Position Overview

• The Information Systems Security Engineer (ISSE) will provide cybersecurity engineering support to the Naval Facilities Engineering Systems Command (NAVFAC) Marianas Command Information Office (CIO). The ISSE will support the protection, operation, and continuous improvement of Facility-Related Control Systems (FRCS) by ensuring the confidentiality, integrity, availability, and security of Government information systems, networks, and data.
• The successful candidate will execute cybersecurity engineering activities supporting the Risk Management Framework (RMF), Authority to Operate (ATO) authorization processes, vulnerability management, continuous monitoring, security assessments, and cybersecurity risk management activities across NAVFAC Marianas installations.
• This position requires demonstrated experience supporting Department of the Navy (DoN) and Department of Defense (DoD) cybersecurity environments, including RMF implementation, NIST SP 800-53 security controls, eMASS authorization package management, vulnerability assessments, Security Technical Implementation Guide (STIG) compliance, Plan of Action and Milestones (POA&M) management, and configuration management activities.
• The ISSE will work independently with minimal Government supervision and serve as a mission-essential cybersecurity resource supporting cybersecurity operations, Configuration Control Board (CCB) activities, and Cyber Emergency Response Team (CERT) functions.

Essential Duties and Responsibilities

• Execute Risk Management Framework (RMF) lifecycle activities (Steps 1-6) in accordance with applicable Department of the Navy (DoN), Department of Defense (DoD), and NAVFAC Echelon II cybersecurity guidance.
• Review and validate:
  • System inventories.
  • Security documentation.
  • Authorization artifacts.
  • Compliance evidence.
  • RMF package information.
• Support Authority to Operate (ATO) authorization activities for Facility-Related Control Systems (FRCS), including:
  • Maintaining and tracking authorization packages.
  • Supporting annual security reviews.
  • Preparing and maintaining Memorandums for Record (MFRs) for approved baseline changes during RMF Step 6 activities.
• Develop, maintain, and update cybersecurity documentation, including:
  • System Security Plans (SSPs).
  • Security policies.
  • Standard Operating Procedures (SOPs).
  • Implementation plans.
  • After-action reports.
  • Cybersecurity-related technical documentation.
• Apply NIST SP 800-53 security controls and tailor cybersecurity requirements to FRCS operational environments.
• Develop and execute vulnerability management strategies using approved DoD and Department of the Navy cybersecurity processes.
• Perform vulnerability and compliance assessments using approved cybersecurity tools, including:
  • ACAS/Nessus.
  • Security Content Automation Protocol (SCAP).
  • Evaluate STIG.
  • Security Center.
  • Vulnerability Remediation Asset Management (VRAM).
• Perform manual Security Technical Implementation Guide (STIG) and Security Requirements Guide (SRG) compliance validation using:
  • .ckl files.
  • .cklb checklist formats.
• Generate cybersecurity assessment reports and maintain vulnerability documentation, including: