Information Systems Security Officer

Future Technologies Inc.; King George (VA); On-site; USD 75,000 - 135,000; Full time

Job summary

Future Technologies Inc. is seeking an experienced Information Assurance professional to support DoD programs, focusing on IA, RMF, and cybersecurity governance for Navy systems.

You will prepare authorization packages, maintain SSP/SCTM/POA&M/RAR/SAP, and coordinate with ISSM/DAA to ensure compliant security posture across lab, land, and afloat environments. Strong communication and diagram-review skills are essential.

Qualifications

• Minimum of five (5) years of IA/CS/RMF experience as ISSO/ISSE.
• Knowledge of DISA STIGs and ACAS vulnerability scans.
• Ability to review and update diagrams to reflect system changes.
• Experience with RMF and PIT systems.
• Excellent written and verbal communication.

Responsibilities

• Provide IA support for development and tactical hardware for Navy programs and systems.
• Prepare authorization documentation for ISSM/DAA using DoD accreditation standards.
• Develop IA/cybersecurity guidelines and SOPs.
• Validate and verify system security requirements/controls and coordinate security capabilities.
• Observe, test, and monitor changes; perform configuration management; notify ISSM of cybersecurity issues.
• Develop, update RMF documentation (SSP, SCTM, POA&M, RAR, SAP).

Skills

Communication skills

Diagrams review

DoD cybersecurity concepts

Vulnerability management

Education

DOD 8140 IAM II

Tools

Microsoft Visio

Cameo

Anchore Grype

Anchore Syft

Job description

Brief Description

• Provide IA support for the development and tactical hardware suites of equipment for H20 programs and products, including laboratory/land-based systems and operational afloat systems. This support includes coordination of system patching, user management, log management, and respective authorization/assess only documentation preparation and review.


• Preparation of the authorization documentation for submission to the respective Information Systems Security Manager (ISSM) or other program specific Designated Approving Authority (DAA), utilizing the appropriate DoD Accreditation standards, policies, and directives.


• Develop IA/cybersecurity guidelines and standard operating procedures (SOPs). Analyze policies, regulations, and system provisions governing standard operating systems. Assists and advise users of policies, regulations, and system provisions for the standard operating systems.


• Validate and verify system security requirements/controls and coordinate integration of system security capabilities for various environments.


• Observe, test, and monitor changes in information systems that might affect the security posture. As the ISSO, the candidate shall perform configuration management for information system security software, hardware, and firmware, and manage changes to systems, assessing their security impact. Additionally, notify ISSM on Cybersecurity issues affecting IT systems and software they are assigned to support.


• Develop, update, and/or review RMF documentation to include the System Security Plan (SSP), Security Control Traceability Matrix (SCTM), Plan of Action and Milestone (POA&M), Risk Assessment Report (RAR), and Security Assessment Plan (SAP)

Brief Description

• Provide IA support for the development and tactical hardware suites of equipment for H20 programs and products, including laboratory/land-based systems and operational afloat systems. This support includes coordination of system patching, user management, log management, and respective authorization/assess only documentation preparation and review.


• Preparation of the authorization documentation for submission to the respective Information Systems Security Manager (ISSM) or other program specific Designated Approving Authority (DAA), utilizing the appropriate DoD Accreditation standards, policies, and directives.


• Develop IA/cybersecurity guidelines and standard operating procedures (SOPs). Analyze policies, regulations, and system provisions governing standard operating systems. Assists and advise users of policies, regulations, and system provisions for the standard operating systems.


• Validate and verify system security requirements/controls and coordinate integration of system security capabilities for various environments.


• Observe, test, and monitor changes in information systems that might affect the security posture. As the ISSO, the candidate shall perform configuration management for information system security software, hardware, and firmware, and manage changes to systems, assessing their security impact. Additionally, notify ISSM on Cybersecurity issues affecting IT systems and software they are assigned to support.


• Develop, update, and/or review RMF documentation to include the System Security Plan (SSP), Security Control Traceability Matrix (SCTM), Plan of Action and Milestone (POA&M), Risk Assessment Report (RAR), and Security Assessment Plan (SAP)

Requirements

• Minimum of five (5) years of experience in Information Assurance, Computer Security, or Risk Management Framework for Department of the Navy systems as an ISSO or Information System Security Engineer (ISSE).


• DOD 8140 certification at IAM Level II certification (e.g., Security+ CE, CASP+, CISM, CISSP).


• Ability to review and update diagrams to accurately reflect system changes.


• Have knowledge of DoD-approved cybersecurity concepts and tools including DISA STIGs and Assured Compliance Assessment Solution (ACAS) scans in support of system vulnerability management and reporting.


• Perform and review technical security assessments to identify vulnerabilities and ensure compliance with information assurance (IA) standards and regulations. This includes vulnerability status tracking and reporting in DoD systems


• Independently prepare and review security documentation, including System Security Plans (SSPs) and Asses Only/Authorization packages. Independently prepare, review, and update authorization packages.


• Demonstrated experience with Risk Management Framework and Platform Information Technology (PIT) systems.


• Excellent written and verbal communication skills along with ability to interface with project lead, software developers, system integrators, and system administrators.


• Experience with Microsoft Visio or Cameo to update system diagrams and defense-in-depth diagrams.


• Has knowledge in DoD-approved cybersecurity concepts and tools including DISA STIGs, Security Content Automation Protocol (SCAP) Compliance Checker, Evaluate-STIG, eMASS, ACAS Scans, and Security Center in support of system vulnerability management and reporting. This includes reviewing IAVMs/IAVAs, tracking vulnerability status and reporting in DoD systems. Additionally, able to register new systems and maintain systems in eMASS.


• Perform annual security reviews, annual testing of security controls, and annual testing of the contingency plan, in line with FISMA requirements. Familiarity with updating PIA forms annually and eAuthentication every three years, or sooner if needed.


• Experience with scanning containers (e.g., Podman and Docker) using Anchore Grype.


• Experience using Anchore Syft to generate a Software Bill of Material (SBOM) from container images and filesystems.

The anticipated salary for this position is $75,000 to $135,000.

Equal Opportunity Employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, gender, gender identity or expression, sexual orientation, national origin, physical or mental disability, age, or veteran status or any other basis protected by federal, state, or local law. U.S. Citizenship may be required for certain positions.

If you need a reasonable accommodation for any part of the employment process, please send an e-mail to [e-mail] and let us know the nature of your request and your contact information. Reasonable accommodation is considered on a case-by-case basis.