Information System Security Officer

Chenega MIOS • Full-time • Remote • $81.70k - $115k / year • 3h ago

Overview

Information System Security Officer

Remote

SecuriGence delivers essential technology services that support our customers’ missions. We are seeking an Information System Security Officer to support the Department of Health and Human Services, Administration for Community Living, Enterprise IT Services Program.

Reporting to the Program Manager, the ISSO maintains system security and privacy documentation, coordinates assessments and authorization activities, tracks risks and remediation, and prepares assigned cybersecurity deliverables. The ISSO works with system owners, technical teams, assessors, privacy personnel, and government security officials to support FISMA compliance and the NIST Risk Management Framework. Government officials retain authorization and risk acceptance decisions.

Responsibilities

The ISSO performs the following security functions for assigned systems and coordinates contributions to related program deliverables. Task references correspond to the supplied PWS Section F delivery schedule.

Security governance and posture — Support compliance with FISMA, NIST security controls, RMF, and applicable HHS/ACL requirements. Prepare or coordinate the Technical Cybersecurity Posture Report and Cyber Security Playbook on the agreed schedule; support quarterly and annual FISMA reporting as required.
Assessment and authorization — Coordinate annual Security Assessment and Authorization activities and annual security control assessments under mutually agreed assessment schedules. Compile evidence, support assessors, track findings, and submit packages for government review and authorization decisions.
Security documentation — Update system security plans, configuration management plans, contingency plans, privacy impact assessments/privacy needs assessments, control assessment plans, and other system documentation annually. Coordinate annual updates to ACL Information Security and Privacy Policy and prepare security impact assessments as required.
Assessment reporting — Prepare or coordinate the Risk Assessment Report, Security Assessment Report and memorandum, and support materials within two weeks after completion of a Security Control Assessment. Ensure findings are traceable to evidence, affected systems, and corrective actions.
Risk and remediation — Maintain risk and issue records and track remediation owners, milestones, evidence, and overdue actions. Prepare the monthly Plan of Action and Milestones Report; support deviation waiver risk documentation as needed and the Risk Review and Accepted Risk Review Schedules when established. Route risk acceptance decisions to authorized government officials.
Continuous monitoring and vulnerabilities — Review vulnerability scans and monitoring results, coordinate remediation with technical teams, verify corrective action evidence, and prepare monthly vulnerability reports in the required format. Support the ACL Cybersecurity Gap Analysis Report, Unsupported Software Lifecycle Report, and Continuous Diagnostics and Mitigation Strategy on schedules to be determined.
Contingency planning — Maintain contingency planning documentation, coordinate the annual Contingency Plan Test, document results and corrective actions, and track follow-through with system owners and operations teams.
Incident response — Maintain the ACL Cybersecurity Incident Response Plan on an ongoing basis. Coordinate security incident reporting, response documentation, communications, exercises, and lessons learned with designated government and contractor response personnel.
Security and privacy awareness — Develop and support ongoing phishing scenarios, tests, educational materials and reports; security awareness communications, training and exercises; security tests, training, educational materials and audits; privacy education; and incident response communications, training and exercises.
Identity and architecture coordination — Review security aspects of identity and access activities and contribute to the monthly Identity/Access Request Log and Zero-trust Architecture Strategy. Coordinate security requirements for asset and license inventories, configuration management, tool/change requests, cloud operating procedures, and technical designs with the responsible leads.
Program reporting and records — Maintain assigned security documentation in OneDrive on an ongoing basis. Participate in biweekly status meetings and provide security inputs to monthly status reports; prepare minutes for assigned meetings within three business days. Ensure all reports’ reference and cite the contract number.
Transition and technical support — Support security knowledge transfer, documentation handover, and transition-in and transition-out planning under the Program Manager’s schedule. Provide ad hoc security technical support and tracking inputs upon request, support quality assurance reviews
Perform other related duties as assigned.

Qualifications

Bachelor’s degree in information technology or cybersecurity, or additional experience in lieu of a degree.
5+ years of experience in cybersecurity, information assurance, or a related field, preferably within a federal environment.
- Certified Information Systems Security Professional, or equivalent experience and knowledge commensurate with certification requirements.
Public Trust background investigation is required.

Preferred Qualifications

5+ years of experience in security architecture, security assessment, or a related cybersecurity role in a federal or government environment.
Certified Information Security Manager or Certified Information Systems Auditor.
Employment screening: Successfully pass background and drug screening.

Knowledge, Skills and Abilities:

Experience with FISMA, NIST RMF, security control assessments, and FedRAMP controls.
Ability to develop and maintain security authorization packages, system security and contingency plans, PIA/PNA documentation, POA&Ms, and security impact assessments.
Ability to translate assessment and vulnerability findings into documented risks, practical remediation actions, and clear management reports.
Proficiency with vulnerability scanners, security information and event management systems, and intrusion detection systems.
Working knowledge of continuous monitoring, CDM, identity and access management, zero-trust concepts, cloud security, incident response, and privacy practices.
Ability to coordinate annual assessments and exercises, deliver security and privacy awareness materials, maintain controlled records, and meet recurring and event-driven reporting deadlines.

How you’ll grow 

At Chenega MIOS, our professional development plan focuses on helping our team members at every level of their careers to identify and use their strengths to do their best work every day. From entry-level employees to senior leaders, we believe there’s always room to learn. 

We offer opportunities to help sharpen skills in addition to hands-on experience in the global, fast-changing business world. From on-the-job learning experiences to formal development programs, our professionals have a variety of opportunities to continue to grow throughout their careers. 

Benefits 

At Chenega MIOS, we know that great people make a great organization. We value our team members and offer them a broad range of benefits. 

Learn more about what working at Chenega MIOS can mean for you. 

Chenega MIOS’s culture 

Our positive and supportive culture encourages our team members to do their best work every day. We celebrate individuals by recognizing their uniqueness and offering them the flexibility to make daily choices that can help them be healthy, centered, confident, and aware. We offer well-being programs and continuously look for new ways to maintain a culture where we excel and lead healthy, happy lives. 

Corporate citizenship 

Chenega MIOS is led by a purpose to make an impact that matters. This purpose defines who we are and extends to relationships with our clients, our team members, and our communities. We believe that business has the power to inspire and transform. We focus on education, giving, skill-based volunteerism, and leadership to help drive positive social impact in our communities. 

Learn more about Chenega’s impact on the world. 

Chenega MIOS News- https://chenegamios.com/news/ 

Tips from your Talent Acquisition Team 

We want job seekers exploring opportunities at Chenega MIOS to feel prepared and confident. To help you with your research, we suggest you review the following links: 

Chenega MIOS web site - www.chenegamios.com 

Glassdoor - https://www.glassdoor.com/Overview/Working-at-Chenega-MIOS-EI_IE369514.11,23.htm 