Job Title: Cyber Security Engineer
FLSA Status: Exempt
Reports To: Program Manager
Location: Ft. Gordon, GA
ABOUT ISC Consulting Group
ISC is a Veteran Affairs Certified Service Disabled Veteran-Owned Small Business (SDVOSB) headquartered in Sierra Vista, Arizona, with offices in Augusta, Georgia and Fullerton, California. Our mission is to enable superior decision making through information dominance. ISC provides advanced education, analytic and technical solutions within strategic DOD and commercial markets. We leverage the best minds and technologies to make a measurable difference
We specialize in delivering mission critical services within the Intelligence Community and the U.S. Military, as well as Federal Government and key commercial clients. ISC's core competencies include C5-ISR, IT Management Operations & Cyber Security, Instructional Solutions, Test & Evaluation Management Operation Services, and Big Data Business Intelligence and Data Analytics.
At ISC, our primary commitment is to provide client driven excellence. This is only possible because of our most important asset, our people. We are recognized by our team members as the best place to work and develop a career, serving our clients with pride and professionalism. Our corporate culture reiterates the importance of "Mission first, People always."
Contingent on Contract Award.
This requirement is to provide Information Technology services and support for enhancement, maintenance and security of the Cyber CoE G6's Network, Enterprise Level Solutions, and IT Services. The G6 will work to design, maintain, and secure IT solutions for the Cyber CoE.
Position General Responsibilities
- The candidate is responsible for applying Cyber Security expertise, including feasibility studies, technical evaluation, justification, acquisition/procurement, installation, implementation, management, and administration of IT systems including virtualized infrastructures and systems (ex. VMWare and OpenStack).
- Serve as Information Systems Security Manager and Trusted Agent for multiple networks.
- The candidate shall assist in the administration of an effective Cyber Security program that involves providing management of organizational risk advice, guidance, and assistance. Stay abreast on changes to Joint, DOD and Army doctrine as it pertains to cyber security and risk management. Maintain up-to-date on IT news regarding network security and future trends in Cyber Security (ex. cloud computing security).
- Update, maintain and test the Disaster Recovery Plan and Continuity of Operation (COOP) to reflect changes in the IT environment.
- Design secure wireless solutions.
- Assists in the coordination of vulnerability assessments, inspections, tests and reviews of the Cyber CoE's information systems and processes.
- The candidate shall have frequent contact with customers and must maintain good customer relations as well as understand and apply the processes of project management.
- Synthesizes system requirements, identifies and assesses alternative solutions, prepares the recommendation in either document and/or briefing format. Presents options to the customer for implementation. Sample expertise includes the preparation of security policies, security plans, user's guides, system administrator guides, or network security design document.
- Responsible for either generating and/or coordinating the compiling all document deliverables required for Certification & Accreditation (C&A).
- Processes, tracks and manages C&A packages into applicable systems (ex. eMass and Xacta IA Manager).
- Identify information protection needs for the NE.
- Define NE security requirements in accordance with applicable IA requirements.
- Provide system related input on IA security requirements to be included in statements of work and other appropriate procurement documents.
- Design security architectures for use within the NE
- Design and develop IA or IA-enabled products for use within a NE.
- Design, Integrate and Implement Cross Domain Solution (CDS) for use within a Computing Environment (CE) or NE.
- Develop and implement security designs for new or existing network system(s).
- Ensure that the design of hardware, operating systems, and software applications adequately address IA security requirements for the NE.
- Design, develop, and implement network security measures that provide confidentiality, integrity, availability, authentication, and non-repudiation.
- Design, develop, and implement specific IA countermeasures for the NE.
- Develop interface specifications for the NE.
- Develop approaches to mitigate NE vulnerabilities and recommend changes to network or network system components as needed.
- Ensure that network system(s) designs support the incorporation of DoD-directed IA vulnerability solutions, e.g., IAVAs.
- Develop IA architectures and designs for DoD IS with medium integrity and availability requirements, to include MAC II, systems with a medium Level-of-Concern for availability or integrity in accordance with Reference (vu), and other DAA designated systems.
- Develop IA architectures and designs for systems processing Sensitive Compartmented Information (SCI).
- Assess threats to and vulnerabilities of the NE.
- Identify, assess, and recommend IA or IA-enabled products for use within an NE; ensure recommended products are in compliance with the DoD evaluation and validation requirements.
- Ensure that the implementation of security designs properly mitigate identified threats.
- Assess the effectiveness of information protection measures used by the NE.
- Evaluate security architectures and designs and provide input as to the adequacy of security designs and architectures proposed or provided in response to requirements contained in acquisition documents
- Ensure security deficiencies identified during security/certification testing have been mitigated, corrected, or a risk acceptance has been obtained by the appropriate DAA or authorized representative.
- Provide input to IA C&A process activities and related documentation (e.g., system life-cycle support plans, concept of operations, operational procedures, and maintenance training materials).
- Participate in an IS risk assessment during the C&A process and design security countermeasures to mitigate identified risks.
- Provide engineering support to security/certification test and evaluation activities.
- Document system security design features and provide input to implementation plans and standard operating procedures.
- Recognize a possible security violation and take appropriate action to report the incident.
- Implement and/or integrate security measures for use in network system(s) and ensure that system designs incorporate security configuration guidelines.
- Ensure the implementation of NE IA policies into system architectures.
- Ensure the implementation of subordinate CE IA policies is integrated into the NE system architecture.
- Assist in Administrative Tasks such as budget creation, account creation, task management, etc.
- Serves as Trusted Agent for SIPRNet Public Key Infrastructure Tokens.
- A minimum of five (5) years' experience in the Information Technology field including a minimum of (3) years' experience in the Cyber Security field.
- At least one (1) year of Certification and Accreditation & Cyber Risk Management experience: DoD RMF (DoD 8500, DoD 8510, NIST 800-37/-53), and DCID 6/3 and ICD 503 processes and frameworks by performing risk assessments, system certification and accreditation.
- Advanced proficiency in NIST SP 800 series, Army IT and IA Regulations (ex. 25-1 and 25-2), DoD Cyber Security Regulations, OWASP, FedRamp, DCID 6/3, ICD (503, 703 and 705) and Cloud Security Alliance framework.
- Strong Knowledge of Cyber Security practices for virtual environments (ex. VMWare and OpenStack).
- Experience in cross-domain system design requirements, certification, and accreditation in both Top Secret Sensitive Compartmented Information and Below Interoperability (TSABI) and Secret and Below Interoperability (SABI) environments such as MLS, MSLS, and MILS solutions.
- Professional level experience developing security-related support documentation for DoD and IC Enterprise and tactical deployments.
- Working knowledge of application assessment, application security vulnerabilities, code review methodologies, and secure coding practices.
- Knowledge of security incident response process and methods.
- Strong working knowledge in the following technologies, security methods and topics: firewalls, proxy servers, load balancing, web application firewalls, vulnerability and code testing, application security, web application security, identification & authentication, cryptography, identity and access management, back-up and disaster recovery, continuity of operations, physical security, security training, host-based security techniques, wireless and other security measures.
- Experience in some of the following testing and monitoring methods:
- Use of Dynamic Code Analysis Tools (ex. HP WebInspect, Veracode).
- Use of Static Code Analysis Tools (ex. HP Fortify, IBM AppScan).
- Use of Vulnerability Testing solutions (ex. Nessus/ ACAS, Qualys, Nexpose).
- Ability to use infrastructure and security monitoring technologies (ex. Splunk, SolarWinds, Nagios, ArcSight).
- Endpoint Protection: (ex. McAfee EPO).
- Awareness of the latest network and application hacking techniques and countermeasures.
- Assists with administrative functions such as status reports, planning and knowledge management.
- Required IASAE II and IAM II certifications for this position in the PWS are as follows:
- Baseline certification: must already possess and maintain current IAM II and IASAE II certification.
- Computing environment (CE) certification: must already possess and maintain current Configuring Windows Server 2012 and Windows 10 Configuration, Configuring Windows Server 2012 Network Infrastructure (070-642), and Windows Server 2012, Server Administrator (070-646), and Windows 10 Configuration (070-680). Other Computing Environment certifications must be obtained within 6 months, if applicable.
- Background investigation is required..
"ISC Consulting Group, Inc. is an Equal Employment Opportunity EEO/Affirmative Action Employer, committed to excellence through diversity. All eligible candidates (minorities, women, veterans, and individuals with disabilities), are encouraged to apply for position vacancies as appropriate. If you would like more information about your EEO rights as an applicant under the law, please click here at http://www.eeoc.gov/employers/upload/poster_screen_reader_optimized.pdf to access the "EEO is the Law" poster. For more information please contact us at email@example.com ."