Information Assurance/Security Specialist
- Level II
- NELLIS Systems Plus
- 3.
2 Nellis AFB, NV Job Details Full-time 1 day ago Qualifications IAT Level III IAM Level III IAT Full Job Description Got the Government Contractor Blues? Looking for a company that cares and goes beyond just filling another contract billet? Well, look no further! Experience this family-oriented company that takes pride in you and will help you grow where your passions lie. Holding many Defense & Federal government contracts around the globe, with Systems Plus, you have the opportunity to take on new and evolving challenges, aim beyond what you think you are capable of, and work in collaborative, dynamic, and high-tempo environments. Our employees are our most valued asset, and we invest in our people because we are in it for the long term. We are committed to your success and well-being and offer competitive benefits packages, salaries, bonus/award programs, and a high potential for professional growth and job opportunities worldwide. Systems Plus is the company for you! Experience the difference, and let's talk about your future at Systems Plus today. Position Title Information Assurance/Security Specialist
- Level II
- NELLIS Position Type Full Time, Onsite Position Location Nellis AFB, NV Tracking Code 01138 Daily Responsibilities Document DISA Security Technical Implementation Guideline (STIG) and Security Requirements Guide (SRG) compliance.
Conducts Assured Compliance Assessment Solution (ACAS) and Security Content Automation Protocol (SCAP) scanning and assessments, and DHA Authorization to Operate (ATO) standards. Update and document Site and Support Locations enclave artifacts in Enterprise Mission Assurance Support Service (eMASS). Assist the system owner and ISSM in various aspects of designing, developing, and writing certification and accreditation (C&A) documentation packages, including support of the ATO and its systems and/or environment, including but not limited to POA&M and other artifacts. Administer and support security reviews of all new or modified systems, devices, and configurations to ensure a consistent security posture. Administer all security related documentation and databases including System Security Authorization Agreements (SSAA), recording mitigation strategies, waivers, approvals, ports and protocol registration, and user rights tracking. Assist in the detailed investigation and documentation of security incidents as required. Support the Government's directive to maintain and sustain all aspects of CAC login and PKI technology and/or other Government authorized or required two factor identification protocol or system. Utilize approved Government scanning tools and or Government provided security protocols, including forensics analysis and Intrusion Prevention System. Provide risk assessments and reviews for system and medical devices deployed and to be deployed on site. Participate in preparing for Command Cyber Readiness Inspections (CCRIs). Support changes required by IAVAs, Information Assurance Vulnerability Bulletins (IAVBs), and Cybersecurity Tasking Orders. Participate in remediation of findings, vulnerabilities, and troubleshooting of subsequent conflicts and problems. Manage tickets (incidents, cases, and requests) that have been initiated and/or assigned to the local site Cybersecurity office or assigned IA support resources. Contractor will obtain and maintain access and familiarity with enterprise tools required for support of RMF, vulnerability management, threat detection, event auditing, IT audits, data loss prevention, and incident response. Coordinate with system owners, administrators, and users to implement security requirements and maintain compliance throughout the system lifecycle. Follows National Institute of Standards and Technology (NIST) and/or Department of War IA Certification and Accreditation Process standards, and Department of War (DoW) security protocols. Conduct Cybersecurity threat monitoring, risk identification, incident mitigation, and administration IAW the DHA RMF Portal. (https://info.health.mil/dadio/InfoSec/assessor/dharmf). The Contractor shall collaborate with the Government Information Assurance and Cyber team to provide updates to the local site RMF package for the information system. The RMF package shall include, at a minimum, the following documents, and artifacts: System Security Plan (SSP): A document that describes the security controls in place for the information system and how those controls are implemented, monitored, and assessed. Security Assessment Report (SAR): A report that provides an assessment of the security controls in place for the information system and identifies any deficiencies or weaknesses. Plan of Action and Milestones (POA&M): A document that outlines the actions required to address any deficiencies or weaknesses identified during the security assessment. Security Authorization Package (SAP): A package of documents that includes the SSP, SAR, POA&M, and other relevant artifacts that are submitted to the Authorizing Official (AO) for review and approval. Continuous Monitoring Plan (CMP): A plan that outlines the ongoing monitoring and assessment of the security controls in place for the information system. The contractor shall provide updates to the RMF package within eMASS and shall be reviewed and approved by the Government Task Manager prior to the deployment of the information system. The Contractor shall also provide the Government Task Manager with ongoing updates to the RMF package. Support Trusted Agents (TAs) requirements related to alternate token or elevated privileges to the network and systems. Support staff with technical assistance beyond that which the service desk staff can manage, such as higher-level knowledge and more time-consuming assistance. Review and Process System Access requests IAW with DHA network access requirements Tracking and coordinating remediation efforts on system POA&Ms. Provide specialized technical expertise and consultative guidance within assigned subject area to support mission objectives. Serve as the Information System Security Officer (ISSO) for designated systems, ensuring compliance with DoW cybersecurity policies and Risk Management Framework (RMF) requirements. Develop, maintain, and enforce system security plans (SSPs), security controls, and associated documentation in accordance with DoW and DHA directives. Oversee system authorization and accreditation processes, coordinating with the Authorizing Official (AO) and security control assessors. Deliver technical briefings and status updates to stakeholders, including risk assessments and mitigation strategies. Perform activities in a lead role to cybersecurity supporting teams Security Vulnerability Tracking Report, Deliverable 5 A monthly report that states the vulnerabilities for all systems and gives status of each vulnerability for burndown to completion This monthly report will include Status of burndown for all IAVM patches that come out from USCYBERCOM, and DHA. Status of system security configuration deficiencies (IAW the DISA STIG, as documented in the POA&M for each of the systems that are maintained by the Service Provider. RMF Package (Deliverable 7): The Contractor shall submit an RMF package (Deliverable 7) for the information system to the Government. The RMF package is a set of documents and artifacts required to implement the RMF process for a specific information system. The RMF package shall include, at a minimum, the following documents, and artifacts: System Security Plan (SSP): A document that describes the security controls in place for the information system and how those controls are implemented, monitored, and assessed. Security Assessment Report (SAR): A report that provides an assessment of the security controls in place for the information system and identifies any deficiencies or weaknesses.
POA&M:
A document that outlines the actions required to address any deficiencies or weaknesses identified during the security assessment. Security Authorization Package (SAP): A package of documents that includes the SSP, SAR, POA&M, and other relevant artifacts that are submitted to the Authorizing Official (AO) for review and approval. Continuous Monitoring Plan (CMP): A plan that outlines the ongoing monitoring and assessment of the security controls in place for the information system. The RMF package shall be submitted in accordance with the requirements identified Table 28
- Contract Deliverables, within eMASS, and shall be reviewed and approved by the Government prior to the deployment of the information system.
The Contractor shall also provide the Government with ongoing updates to the RMF package as required by the Continuous Monitoring Plan. Other duties as assigned.
Required:
Experience Four (4) years of progressive experience demonstrating the required proficiency.
Required:
Degree Bachelor's degree and/or equivalency.
Required:
Certification
IAT III IAM III CE
Associate level (professional preferred) certificate for supported technology as approved by the COR.
Required:
Clearance No clearance needed. Applicant must obtain and maintain a favorable suitability adjudication. About Systems Plus Systems Plus is headquartered in Rockville, MD with over 2 decades of experience providing Global Enterprise Management, Technology, Engineering and Professional services and solutions across Defense and Federal Civilian government sectors. From Discovery to Delivery, Systems Plus brings a greater measure of confidence, commitment and value to our clients. With various Defense and Federal contracts across the United States, Europe and Pacific/Asia, we are driving innovation and excellence within the Special Operations Forces Components and Commands, Defense Health Agency, United States Air Force, United States Marine Corps, National Institute of Standards and Technology, House of Representatives and more. Through our diverse portfolio of clients and capabilities we power vision and insight—discover what's possible with a Small Business that thinks BIG! Interested individuals should email their resume with salary expectations and with a cover letter to .
