Information Systems Security Officer

Capstone is seeking an Information Systems Security Officer to support the Joint Multinational Simulation Center. The ISSO works with System Administrators (SA), Command Information System Security Manager (ISSM), other Information System Security Officers (ISSOs), multiple Branch Heads, multiple Program Managers (PMs) and a project strategist in support of the completion of a mixture of A&A boundaries consolidated into overarching master boundaries in support of information assurance policy and regulations. In addition to A&A package development, the individual will be responsible for the day to day operations as an ISSO.

• Develops and maintains an organizational or system-level cybersecurity program that includes cybersecurity architecture, requirements, objectives and policies, cybersecurity personnel, and cs.
• Provides support to the System Owner and the ISSM for maintaining the appropriate operational IA posture for a system, program, or enclave.
• Provides support to the customer on all matters involving the security of their information systems.
• Assists with the management of all security aspects of the information system and as assigned performs day-to-day security operations of the system.
• Assists in the development of the system security policy and ensures compliance with that policy on a routine basis.
• Prepares, validates, and maintains security documentation including, but not limited to: system security plan (SSP), risk assessment (RA), contingency plan (CP), privacy impact assessment (PIA), eAuthentication assessment, FIPS categorization.
• Provides configuration management for security-relevant information system software, hardware, and firmware, controlling changes to the system and assessing the security impact of those changes.
• Identifies and mitigates security business and system risks.
• Identifies and manages POA&Ms through remediation as well as develop corrective action plans for each POA&M.
• Maintains a repository for all organizational or system-level cybersecurity-related documentation such as DIACAP/RMF processes within eMASS or other automated process.
• Maintains Defense Information Technology Portfolio Registry (DITPR) for client systems and software.
• Ensures implementation of Information System (IS) security measures and procedures, including reporting incidents to the Command Information System Security Manger (ISSM) and appropriate reporting chains as well as coordinating system-level responses to unauthorized disclosures in accordance with DoDM 5200.01 Vol 3 for classified information or DoDM 5200.01 Vol 4 for CUI, respectively.
• Implements and enforces all DoD IS and Platform Information Technology (PIT) system cybersecurity policies and procedures, as defined by cybersecurity-related documentation.
• Ensures that all users have the requisite security clearances and access authorization, and are aware of their cybersecurity responsibilities for DoD IS and PIT systems under their purview before being granted access to those systems.
• In coordination with the ISSM, initiates protective or corrective measures when a cybersecurity incident or vulnerability is discovered.
• Establishes a process for authorized users to report all cybersecurity-related events and potential threats and vulnerabilities to the ISSO.
• Ensures that all DoD IS cybersecurity-related documentation is current and accessible to properly authorized individuals.
• Ensures proper Configuration Management procedures are followed. Prior to implementation and contingent upon necessary approval with the ISSM.
• Initiates requests for temporary and permanent exception, deviations, or waivers to IA requirements such as Plan of Action and Milestones (POA&Ms).
• Ensures IA and IA-enabled software, hardware and firmware comply with appropriate security configuration guides.
• Provides status updates of assigned duties to the appropriate agency heads as defined in their respective Service Level Agreement (SLA).
• Responds to all applicable data calls, CTO’s, FRAGO’s, IAVA’s ,etc within the requested timeframe.
• Attends all Cybersecurity Workforce Meetings when requested.

Minimum education and experience:

• Bachelor’s degree plus three (3) years of recent specialized experience OR an Associate’s degree plus seven (7) years of recent specialized experience OR a major certification plus seven (7) years of recent specialized experience OR eleven (11) years of recent specialized experience.

Minimum qualifications:

• A working knowledge of RMF and the security authorization processes and procedures.
• Knowledge of NIST Special Publications and their counterparts, especially SP800-37, SP800-53, ICD 503, and CNSS 1253. Ability to communicate clearly and present information to the customer in a format they can understand.
• Experience in the following areas: knowledge of current security tools, hardware and software security implementation; different communication protocols; and encryption techniques/tools.
• Familiarity with commercial security products, security authorization techniques, security incident management, and PKI and authorization services.
• Must be able to prioritize tasks, deliver solutions on time and be a team player with the ability to work independently and proactively while being flexible and prioritizing competing priorities, often under time constraints.
• Have strong analysis, oral and written communication, and change management skills with ability to plan, organize, prioritize, track, manage, and learn new skills.
• Technical familiarity with Windows 7 Enterprise/Windows 10 Professional, Windows Server 2012, and Red Hat Linux.
• Proficiency with using the Internet and with Microsoft Office products
  including e-mail, Word, Excel, Access and Project is required.
• Ability to speak, write and understand English.

Certification:

• DoD Approved 8570 Baseline Certification for a minimum of IAM Level II

Minimum clearance:

• Secret Clearance with the ability to obatin a Top Secret Clearance

EOE minority/female/disability/veteran

- One (1) one year of experience under the DoD Information Assurance Certification and Accreditation Process (DIACAP) and/or Risk Management Framework (RMF) accreditation process and has a familiarity with Enterprise Mission Assurance Support Service (eMASS).
- Experience with providing IA or IT support to a US Army client desirable.