Vacancy expired!
- Work with system owners to close IAVMs/ICVMs and open Plan of Action and Milestones (POA&Ms) in a rapid fashion, in accordance with DoD instructions/directives. Review all POA&MS with the Program Manager on at least a quarterly basis and update the POA&Ms accordingly.
- Provide Defense in Depth principles and technology in security engineering designs and implementation
- Analyze existing and future systems, reviewing security architectures, and developing engineering solutions that integrate information security requirements to proactively manage information protection
- Apply security risk assessment methodology to system development, including assessing and auditing network penetration testing, antivirus deployment, risk analysis
- Conduct Computer Incident Response Team (CIRT) activities, including forensic analysis
- Plan, implement, and manage a Defense In Depth for the total network and/or enclaves within the network to include such items as: scanning, remediation, host and network intrusion detection/prevention, firewalls, proxy servers, web cache, virus programs, vulnerability scanning, content filtering, remote dial in protection, Host Based Security Services, Directory Services, and Certification and Accreditation, DoD Instruction 5200.40, accreditation guidance and advice IAW AR 25-2 and IA Best Business Practices (BBPs). Plan, respond, investigate, and report undisclosed classified incident remediation.
- Maintain Agency public key infrastructure system Implement security designs in hardware, software, data and procedures
- Provide support for the Department of Defense (DoD) Public Key Infrastructure (PKI) service.
- Responsible for requesting, receiving, installation, and accountability of system (server) PKI certificates and providing technical support for PKI.
- Provide communications security (COMSEC) rekeying support within normal business hours or on-call, as required. Prepare and maintain secure communications devices and crypto keys. Provide Certification and Accreditation, as well as provide Automated Information System Accreditation support
- Bachelor's Degree in Computer Science, Cybersecurity, Computer Engineering, or related discipline. Comparable experience in lieu of degree may be considered.
- 5+ years of experience performing Information Assurance functions and using RMF IT security controls and policies preferred.
- Must possess and maintain an IT I level certification IAW AR 25-2 and IAT-II/IAM-II certification IAW DoD 8570.01-M.
- Must be a US citizen.
- A track record of progressively responsible information assurance experience in one or more of the following information security areas: certification and accreditation, IA system evaluations, system security penetration testing, and IA security operations/network monitoring, Intrusion Detection Systems, Intrusion Prevention Systems, Security Information Management/Security Event Management, network mapping, vulnerability scanners, firewalls, routers and other security tools
- Candidate must have at least 3 years of experience in the IT industry, and be familiar with the applicable NIST Special Publications 800-37 Revision 1, 800-53 Revision 3 or 4, and 800-53A Revision 1.
- Experience and basic knowledge of networking components and various operating systems in a cloud environment, including UNIX and Microsoft is a plus.
- Expertise in other Security Frameworks (ISO, NIST, COBIT, HIPAA/HITECH, etc.) and regulatory requirements is a plus
- Experience working in CMMI Level 3 (or higher) environments is a plus