ISSO (TS/SCI for NGA--Gaithersburg, MD)

Primary Responsibilities:

• Develops risk mitigation strategies that contribute to the effectiveness, efficiencies, and performance outcomes for strategic projects, program goals, and business processes.
• Must be able to quickly respond to the needs for updates and maintenance of security documentation, especially System Security Plans, Plans of Actions and Milestones (POA&Ms); Security Impact Assessment for proposed system changes, and Concept of Operations that identify and explain how each system satisfies its assigned security control baselines.
• Maintains system security plans and related configuration records in customer Service+ (ServiceNow), XACTA-360 platform, and Leidos-CIO security tools.
• Drives necessary security changes through steering groups and control (review) boards to meet Risk Management milestones.
• Can work independently as well as collaboratively to drive security process improvements, especially to address gaps in meeting customer or Leidos security requirements and meet due diligence responsibilities.
• Provides guidance and engages the program lab team to implement secure software and hardware processes, apply government security standards, and commercial best security practices.
• Resolves highly complex security problems by applying technical knowledge, conceptualizing, reasoning, and interpretation of requirements.
• Communicating with Leidos and NGA leadership (internally or client) regarding matters of significant importance to the organization/project.
• Apply in-depth understanding of information security technical principles, theories, concepts, and their application across a range of programs.
• Develop and maintain security documentation per NGA/IC/DoD-DISA/NIST/Industry standards and policies.
• Initiate and coordinate all Assessment and Authorization (A&A) and renewal activities working with the NGA Designated Authorization Officials (DAO or DAOR).
• Address any Information Assurance or Cybersecurity notices, orders, tasking, or directives as required following the NGA operations vulnerability and patch management processes.
• Measure effectiveness of defense-in-depth architecture and Zero Trust policy implementations against known vulnerabilities.
• Perform security audits and assessments, including creating, tracking, and assisting in remediation of Plan of Action and Milestones (POA&Ms).
• Coordinate with System Administrators and others to remediate all vulnerabilities and report results. Track open vulnerabilities and obtain and document approvals while managing POA&M status.
• Update Security CONOPS and Information Technology Disaster Recovery (ITDR) plans for each Security Plan.
• Manage security profiles and implementation for systems and services scheduled for Assessment and Authorization (A&A).
• Work with the Systems Engineers and Administrators, Senior ISSO, ISSMs, Lab Team, and Leidos Corporate Security as required to develop and maintain security plans and associated documentation.
• Maintain records and documentation on program IT systems, upgrades, patches, and connectivity configurations.
• Evaluate security solutions and implementation strategies for program IT systems and services and maintains operational security posture of development, integration, and deployed capabilities.
• Provide training and approve user access and IAA (identification, authorization, and authentication) mechanisms for information systems.

Basic Qualifications:

• BS degree and 8 to 12 years of prior relevant experience to operate within the scope of responsibilities.
• Active TS-SCI clearance with Polygraph
• NGA experience desired.
• Experience that demonstrates an understanding and application of the ICD-503 and NIST risk management framework.
• Experience desired with the following systems/platforms/tools: XACTA; XACTA 360 (preferred); HBSS; ACAS; Nessus, SPLUNK.

Preferred Qualifications:

• Has 3+ years of experience operating, analyzing, and resolving vulnerability scan results using tools such as Nessus, Tenable Security Center, or a comparable commercial or GOTs product.
• Active Certified Information Systems Security Professional (CISSP) certification or ISACA Certified Information Security Manager (CISM) certification.
• Intelligence Community experience preferred.