Information Systems Security Officer

This is a fully remote position, open to applicants in United States.

📋 Description

• Assist in a government program by implementing NIST SP-800-53 controls, overseeing security posture, analyzing vulnerabilities, and coordinating remediation efforts across AWS, applications, APIs, and infrastructure.

• Work closely with technical leaders, business stakeholders, and a diverse team to ensure that solutions are scalable, secure, and in alignment with organizational and program objectives.

• Maintain regular communication with DHS clients and internal engineering teams.

• Direct the necessary RMF process steps to evaluate and authorize systems, securing and retaining a full ATO.

• Aid in the preparation and review of RMF documentation packages for risk assessments.

• Develop and implement security testing plans and analyses needed to finalize RMF package documents for submission and approval.

• Employ vulnerability scanning tools and frameworks to assess the security posture of systems.

• Conduct monthly continuous monitoring reports, including the analysis of scans, logs, and accounts.

• Collect, document, and interpret business requirements.

• Lead stakeholder and team meetings.

• Generate security reports and ensure the completion of security tasks.

• Assist clients in organizing training and tabletop exercises focused on contingency planning, incident response, and disaster recovery.

• Complete ISSO training provided by USCIS as necessary.

⛳️ Requirements

• Minimum of 5 years of professional experience in a cybersecurity-related field.

• Bachelor's Degree in an IT-related discipline.

• A cybersecurity-related certification is mandatory.

• An AWS-related certification is preferred.

• Must be eligible to obtain and maintain a Public Trust security clearance.

• United States citizenship is required for security clearance eligibility.

• Must be a resident of the continental United States.

• In-depth understanding and professional experience with NIST SP 800-53 controls and their application within the Risk Management Framework (RMF).

• Strong knowledge and hands-on experience with API-based security mechanisms and the OWASP framework addressing web application vulnerabilities.

• Professional experience with CSAM, STIGs, and SRGs.

• Familiarity with cloud security posture management (CSPM) tools, such as AWS Security Hub, AWS Config, AWS Trusted Advisor, or Amazon GuardDuty.

• Experience using AWS.

• Proven track record in leading RMF for IATT/ATO activities involving custom on-prem and cloud solutions.

• Experience in assessing risks associated with deficiencies identified during RMF control testing and managing corrective actions.

• Proficient in using cybersecurity tools or scanners to evaluate system security posture, including scanning or reporting for web applications, databases, containers, or other system components.

• Experience with digital certificates and public key infrastructure (PKI).

• Familiarity with vulnerability management tools such as Tenable or Nessus.

• Experience using status code analysis tools like SonarQube.

• Knowledge of static application security testing tools such as Checkmarx.

• Familiarity with Nexus IQ or other software dependency scanning tools.

• Understanding of Prisma Cloud Compute (formerly Twistlock) or similar container scanning tools.

• Proficient in AWS architecture and possess a technical understanding of cloud technologies, including microservices, containers, zero trust concepts, data streaming, or data pipelines.

• Experience with continuous monitoring, preparing monthly status reports, and analyzing and reporting cybersecurity vulnerability scan results.

• Skilled in requirements analysis, security architecture and design, and documenting cybersecurity or information security solutions.

• Ability to gather and create security requirements, collaborate with stakeholders, facilitate meetings, and track security tasks to completion.

• Understanding of CI/CD pipeline and enterprise DevSecOps implementation.

• Working knowledge of Agile and DevSecOps practices along with cybersecurity, network, systems, and software engineering principles.

• Familiarity with Atlassian tools, including Jira, Confluence, and Splunk.

• Knowledge of Artificial Intelligence / Machine Learning is preferred.

• Understanding of ETL data pipelines.

• Ability to work standard business hours in alignment with the Eastern Time Zone.

• Occasional lifting and carrying of equipment or materials up to 20 pounds may be required.

• Occasional travel to client sites or meetings may be necessary.

🏝️ Benefits

• Comprehensive nationwide medical, dental, and vision insurance.

• 3 weeks of Paid Time Off.

• 11 Paid Federal Holidays.

• 401k matching program.

• Life Insurance provided at no cost to employees.

• Short-Term Disability coverage at no cost to employees.

• Long-Term Disability coverage at no cost to employees.

• Options for supplemental insurance.

• Flexible spending accounts available.

• Dependent Care spending accounts offered.

• Wellness incentives provided.

• Reimbursement for professional development and certifications.

• Training assistance opportunities to foster career growth and advancement.

• Hybrid and remote work opportunities to promote work-life balance.

• Flexible scheduling options available.

• Reasonable accommodations provided for the application and interview process.

• Opportunities for bonuses, where applicable.