Sr. ISSO for DHS/TS

This is a high profile, dynamic work environment supporting the front lines of our Homeland Security. The position shall serve as the Senior Information Systems Security Officer (ISSO) for information assurance activities at the IT system level.

The Senior ISSO shall ensure that management, operational, and technical controls for securing either National Security Systems or SBU level Information Systems are in place and are followed. This includes ensuring that appropriate steps are taken to implement information security requirements for IT systems throughout their life cycle, from the requirements definition phase through disposal. The Senior ISSO shall possess effective interpersonal and presentation skills as he/she operates in a client-facing role. The Senior ISSO must possess experience with NIST 800 publications standards. The position requires experience with vulnerability scanning and assessments. The Senior ISSO shall conduct Assessment and Authorization (A&A) activities in accordance with NIST 800-37 standards. All A&A deliverables must meet the metrics in the DHS Information Security Performance Plan. The Senior ISSO shall also respond to Information Security Vulnerability Management (ISVM) notifications and ensure all systems under their purview are in compliance with DHS IT Policies. The Senior ISSO shall manage single or multiple systems depending on the size and complexity. This position supports the TSA IT Information Assurance and Cybersecurity Division (IAD), Enterprise ISSO Services Branch (EISB). All FISMA authorization documentation is maintained in the Cyber Security Assessments and Management (CSAM) system, the TSA system of record, and assigned systems operate under DHS Ongoing Authorization (OA) with monthly scheduled reviews. Each assigned ISSO receives a CISO designation letter identifying them in writing as the cybersecurity expert for their system(s).

Job Description:

• Execute Risk Management Framework Assessment and Authorization activities.
• Assist in developing unified guidelines and procedures for conducting authorizations and/or system-level evaluations of federal information systems and networks including the critical infrastructure of DHS.
• Develop and present, both verbally and in writing, highly technical information and presentations to non-technical audiences at all levels of the organization; audiences for this information include, but are not limited to, senior executives at DHS and other agencies.
• Ensure IT systems have all security controls in place and functioning properly in accordance with NIST 800-53A publication.
• Conduct and evaluate/analyze vulnerability results from security tools including but not limited to: Tenable.sc/NESSUS, Splunk, AppDetective, and WebInspect.
• Support onsite external and internal audits for designated systems.
• Report incidents within the time frame prescribed by DHS 4300 policy for incident response.
• Maintain all system authorization artifacts in CSAM and ensure documentation meets EISB quality thresholds for acceptance.
• Execute DHS Ongoing Authorization (OA) monthly scheduled reviews and RMF Steps 0-Prepare, 1-Categorize, 2-Select, 3-Implement, and 6-Continuous Monitoring for assigned systems.
• Manage system POA&Ms per DHS and TSA policy, and document identified vulnerabilities or findings in the mandated DHS compliance tool within one (1) business day.
• Complete and maintain the annual artifact package — FIPS-199 categorization, Privacy Threshold Analysis (PTA), E-Authentication, Contingency Plan (CP), Contingency Plan Test (CPT), Security Plan, and NIST SP 800-53A control self-assessment test cases — against the compliance due dates in the RMF Readiness Guide.
• Facilitate PKI certificate renewals and revocations for assigned FISMA systems prior to expiration.
• Perform weekly audit log reviews and vulnerability scanning reports for continuous monitoring using Government-furnished tools (Splunk, Tenable).
• Serve as alternate ISSO on assigned systems to ensure continuous coverage.
• Support bi-annual System Owner Scorecard reviews and keep FISMA System Profiles current on a monthly basis.
• Contribute to Enterprise ISSO training delivery — monthly ISSO sessions, quarterly System Owner town halls, and ad hoc Lunch and Learn sessions — and to the ISSO Knowledge Guide and SharePoint repository.

Minimum Qualifications and Education/Certification Requirements:

• At least three (3) years of experience as an ISSO or performing the duties of an ISSO
• Minimum of five (5) years of experience in Federal IT Security.
• Must possess one of the following security professional certifications: CGRC, CISSO, CISM, or CISSP
• Thorough knowledge of, and experience with, the NIST 800 series publications to include: 800-30, 800-37, 800-53, 800-53A, 800-60, 800-137 (continuous monitoring), and 800-18 (security plans).
• Previous experience creating ALL necessary A&A documentation.
• At least one year of experience leveraging Tenable and Splunk for continuous monitoring
• Working knowledge of enterprise network and cloud architectures (routers, switches, firewalls, virtual networks) sufficient to document system boundaries, interconnections, and hardware/software inventories.
• Active Secret or Top Secret clearance

Preferred Qualifications:

• Current badge from DHS or a DHS component
• CSAM/JCAM Experience
• Experience as a security control assessor.
• Prior ISSO experience at TSA or another DHS component.
• Experience authorizing or maintaining FedRAMP-authorized cloud services (AWS, Microsoft Azure, Office 365, Salesforce, ServiceNow).

Pay: $140,000.00 per year

Benefits:

• 401(k)
• 401(k) matching
• Dental insurance
• Employee assistance program
• Flexible spending account
• Health insurance
• Health savings account
• Life insurance
• Paid time off
• Professional development assistance
• Referral program
• Retirement plan
• Tuition reimbursement
• Vision insurance

Experience:

• DHS: 1 year (Preferred)
• ISSO: 3 years (Required)
• Federal IT: 5 years (Required)

Security clearance:

• Secret (Required)

Work Location: Hybrid remote in Springfield, VA 22150

Salary : $140,000