Job Information
Frontier Technology Inc. Security Control Assessor-Risk Management in Suffolk, Virginia
Overview
At FTI, we are united by one common mission; supporting those that protect our nation so they can make the best-informed decisions during critical moments when seconds count. We want you to bring your passion and expertise to contribute to that essential mission. We strive to incorporate our values to create a culture of collaboration and trust, where you can share your ideas and innovate. If you are inspired by making a positive impact through developing data driven solutions, FTI would appreciate the opportunity to learn more about you.
We are hiring an Advisory Security Control Assessor-Risk Management to support the Navy Cyber Defense Operations Command (NCDOC). In this position, you will conduct. independent comprehensive assessments of the management, operational, and technical security controls and control enhancements employed within or inherited by an information technology (IT) system to determine the overall effectiveness of the controls (as defined in NIST SP 800-37)
Responsibilities
Certified Information Systems Security Professional (CISSP) certification.
1-3 years of experience with Assured Compliance Assessment System (ACAS) and/or Nessus.
5-10 years Certification and Accreditation (C&A) package assembly experience
Risk Management Framework (RMF) training and certification is desired
Prior appointment as a Fully Qualified Navy Validator is preferred (experience with DOD validation will be considered on a case by case basis)
Education/Qualifications
Create, review, update, and validate Cybersecurity Standard Operations Procedures (SOPs) as required.
Review and maintain an inventory of authorized software (software custodian).
Review and maintain an inventory of devices and media.
Audit and validate configurations deployed on laptops, workstations, and servers.
Audit and validate configurations of network devices based on DISA STIGs, or defining and implementing compensating controls of such STIGs as required to ensure mission execution.
Maintain and update all Risk Management Framework (RMF) and C&A documentation to ensure the relevancy and currency of Cyber threat emulation assets to include required revisions and updates in eMass.
Conduct comprehensive annual RMF package reviews to ensure continued compliance of the Cyber threat emulation tool suite and/or Networks.
Ensure traceability is maintained throughout the RMF submission process (e.g.: C&A Plan, POAM, RAR, Topology, Software, Ports Protocols and Services, Test Plan).
Maintain network and system documentation in DITPR-DON / DADMS.
Maintain documentation and registration of Network Ports, Protocols, and Services.
Maintain circuit registrations in Global Interconnection Approval Process System (GIAP) and Systems/Network Approval Process (SNAP).
Maintain and report on the status of all outstanding C&A items and supporting documentation.
As a member of the Configuration Control Board (CCB), ensures CCB approved changes are timely and accurately reflected in the C&A documentation.
Support compliance validation of current and future directives (e.g.: IAVs, STIGs, CTOs).
Provide recommendations for corrective action of any non-compliant security controls.
Execute DISA STIG validations for systems in conjunction with C&A package reviews annually.
Provide security expertise to ensure security controls are implemented and the resulting documentation and artifacts are current.
Prepare reports on scanning results and configuration management observations monthly.
Document assessment activities and results in sufficient detail to enable external review of all assessment processes, activities, results, and conclusions.
Conduct and document a semi-annual table-top exercise (two times) each calendar year.
Produce test plans, draft after actions and other documents for review and comment.
Review and/or revise Business Impact Analysis (BIA) to include business process, IT dependency, and physical security assessments annually.
Review and analyze IT contingency / disaster recovery plans for NIST and DoN Compliance, and produce checklists for IT systems.
Assist with exercise and/or training and documentation of IT contingency plan and execution.
#LI-KC1
#LI-Onsite
ID2024-6362
CategoryIT
TypeRegular Full-Time
Location : LocationUS-VA-Suffolk
Clearance RequirementsSecret