Geospatial ISSO DHS

CFocus Softwareorporated

Job Location:

Springfield, VT - USA

Monthly Salary: Not Disclosed

Posted on: 3 days ago

Vacancies: 1 Vacancy

Job Summary

Bachelors or masters degree in IT Computer Science Geography or a related field.
6 years of cybersecurity or information-assurance experience including at least five years performing ISSO system-security RMF authorization compliance or continuous-monitoring responsibilities for federal information systems.
Demonstrated experience implementing and assessing NIST SP 800-53 security controls and maintaining SSPs authorization artifacts POA&Ms control evidence and continuous-monitoring records.
Experience supporting FISMA authorization and ongoing authorization ATO/ATC activities vulnerability and patch management security assessments audit/data-call responses and change-control security reviews.
Knowledge of DHS MD 4300A or comparable federal sensitive-system policy NIST Risk Management Framework NIST SP 800-37 NIST SP 800-53 NIST SP 800-137 FISMA OMB A-130 and federal privacy/security requirements.
Experience analyzing authenticated scan results adjudicating findings coordinating remediation validating evidence and reporting security posture and risk to Government stakeholders.
Ability to advise a Government System Owner and collaborate effectively with engineers developers administrators architects cloud teams privacy personnel assessors and program leadership.
Strong technical writing analysis organization communication and documentation-quality skills.
Ability to satisfy DHS suitability background-investigation Entry on Duty security and system-access requirements for the assigned position.
Active CISSP CISM GSLC CAP/CGRC CASP or another advanced information-security or risk-management certification.
Experience serving as an ISSO for DHS another federal civilian agency or a mission-critical FISMA Moderate/High system.
Working knowledge of ESRI Portal/ArcGIS Enterprise ArcGIS Online geospatial web services enterprise geodatabases custom GIS applications or location-intelligence environments.
Experience securing AWS or other enterprise cloud environments identity and access integrations APIs web applications data pipelines and hybrid infrastructures.
Experience with DHS ISVM processes and Swimlane or comparable vulnerability/compliance workflow platforms.
Experience with privacy compliance interconnection agreements contingency planning and exercises Section 508 IPv6 DevSecOps or system-security engineering

Duties:

Serve as the principal advisor to the GII System Owner on cybersecurity requirements risk compliance authorization posture control effectiveness and security impacts across geospatial capabilities.
Interpret and apply DHS MD 4300A Sensitive Systems Policy DHS security authorization guidance FISMA OMB and NIST requirements DHS privacy rules and other applicable directives throughout the Systems Engineering Life Cycle.
Coordinate with GMO leadership developers system administrators architects cloud providers data managers technical support privacy personnel DHS security organizations and other enterprise stakeholders.
Assess emerging technical operational and geospatial requirements for security implications and provide timely risk-informed recommendations to the System Owner and program leadership.
Maintain clear separation of authority: provide guidance and recommendations while preserving final Government decisions approvals risk acceptance and signatures
Ensure implementation maintenance and evidence of management operational and technical security controls required by the GII System Security Plan (SSP) and DHS policy.
Maintain the SSP and supporting authorization documentation so that system boundaries components data flows interfaces control implementation statements responsibilities and evidence reflect the current operating environment.
Coordinate control implementation and evidence collection for ESRI Portal ArcGIS Online AWS-hosted applications and infrastructure identity and access services geospatial data services custom applications networks and enterprise integrations.
Identify control gaps weaknesses dependencies and inherited-control issues; assign or coordinate remediation ownership and track corrective actions through approved processes.
Support annual SSP updates and other security-documentation refreshes required by the DHS authorization and compliance lifecycle.
Execute the GII Information Security Continuous Monitoring (ISCM) program and provide current visibility into system assets vulnerabilities configuration control effectiveness and changes in security posture.
Coordinate and review credentialed/authenticated scans and other automated security-management outputs in accordance with the current ISCM strategy.
Review validate and adjudicate findings from continuous monitoring vulnerability diagnosis patching configuration assessment and mitigation activities.
Perform and document monthly ISCM review and adjudication activities maintain traceable evidence identify trends and recurring weaknesses and escalate material risks.
Coordinate with operations and engineering teams on monthly patching emergency fixes vulnerability remediation and follow-up validation while minimizing mission disruption.
Maintain dashboards metrics findings status and decision-support reporting needed to demonstrate confidentiality integrity availability and continued authorization
Prepare maintain validate and organize artifacts supporting assessment authorization certification/accreditation Authority to Operate (ATO) and Authority to Connect (ATC) activities.
Coordinate evidence requests control assessments security testing authorization reviews and remediation activities with assessors technical teams program personnel and DHS stakeholders.
Maintain an authorization-ready posture by ensuring artifacts are accurate current internally consistent traceable and aligned with the operational environment.
Respond to DHS cybersecurity investigations data calls and requests for information concerning the GII security posture.
Support compliance reporting and corrective actions arising from security assessments audits vulnerability reviews and Government direction.

Required Experience:

Senior IC

cFocus Software seeks a Geospatial ISSO to join our program supporting the Department of Homeland Security (DHS). This position is remote. This position requires a Public Trust Clearance.Qualifications:Bachelors or masters degree in IT Computer Science Geography or a related field.6 years of cyberse...

Bachelors or masters degree in IT Computer Science Geography or a related field.
6 years of cybersecurity or information-assurance experience including at least five years performing ISSO system-security RMF authorization compliance or continuous-monitoring responsibilities for federal information systems.
Demonstrated experience implementing and assessing NIST SP 800-53 security controls and maintaining SSPs authorization artifacts POA&Ms control evidence and continuous-monitoring records.
Experience supporting FISMA authorization and ongoing authorization ATO/ATC activities vulnerability and patch management security assessments audit/data-call responses and change-control security reviews.
Knowledge of DHS MD 4300A or comparable federal sensitive-system policy NIST Risk Management Framework NIST SP 800-37 NIST SP 800-53 NIST SP 800-137 FISMA OMB A-130 and federal privacy/security requirements.
Experience analyzing authenticated scan results adjudicating findings coordinating remediation validating evidence and reporting security posture and risk to Government stakeholders.
Ability to advise a Government System Owner and collaborate effectively with engineers developers administrators architects cloud teams privacy personnel assessors and program leadership.
Strong technical writing analysis organization communication and documentation-quality skills.
Ability to satisfy DHS suitability background-investigation Entry on Duty security and system-access requirements for the assigned position.
Active CISSP CISM GSLC CAP/CGRC CASP or another advanced information-security or risk-management certification.
Experience serving as an ISSO for DHS another federal civilian agency or a mission-critical FISMA Moderate/High system.
Working knowledge of ESRI Portal/ArcGIS Enterprise ArcGIS Online geospatial web services enterprise geodatabases custom GIS applications or location-intelligence environments.
Experience securing AWS or other enterprise cloud environments identity and access integrations APIs web applications data pipelines and hybrid infrastructures.
Experience with DHS ISVM processes and Swimlane or comparable vulnerability/compliance workflow platforms.
Experience with privacy compliance interconnection agreements contingency planning and exercises Section 508 IPv6 DevSecOps or system-security engineering

Duties:

Serve as the principal advisor to the GII System Owner on cybersecurity requirements risk compliance authorization posture control effectiveness and security impacts across geospatial capabilities.
Interpret and apply DHS MD 4300A Sensitive Systems Policy DHS security authorization guidance FISMA OMB and NIST requirements DHS privacy rules and other applicable directives throughout the Systems Engineering Life Cycle.
Coordinate with GMO leadership developers system administrators architects cloud providers data managers technical support privacy personnel DHS security organizations and other enterprise stakeholders.
Assess emerging technical operational and geospatial requirements for security implications and provide timely risk-informed recommendations to the System Owner and program leadership.
Maintain clear separation of authority: provide guidance and recommendations while preserving final Government decisions approvals risk acceptance and signatures
Ensure implementation maintenance and evidence of management operational and technical security controls required by the GII System Security Plan (SSP) and DHS policy.
Maintain the SSP and supporting authorization documentation so that system boundaries components data flows interfaces control implementation statements responsibilities and evidence reflect the current operating environment.
Coordinate control implementation and evidence collection for ESRI Portal ArcGIS Online AWS-hosted applications and infrastructure identity and access services geospatial data services custom applications networks and enterprise integrations.
Identify control gaps weaknesses dependencies and inherited-control issues; assign or coordinate remediation ownership and track corrective actions through approved processes.
Support annual SSP updates and other security-documentation refreshes required by the DHS authorization and compliance lifecycle.
Execute the GII Information Security Continuous Monitoring (ISCM) program and provide current visibility into system assets vulnerabilities configuration control effectiveness and changes in security posture.
Coordinate and review credentialed/authenticated scans and other automated security-management outputs in accordance with the current ISCM strategy.
Review validate and adjudicate findings from continuous monitoring vulnerability diagnosis patching configuration assessment and mitigation activities.
Perform and document monthly ISCM review and adjudication activities maintain traceable evidence identify trends and recurring weaknesses and escalate material risks.
Coordinate with operations and engineering teams on monthly patching emergency fixes vulnerability remediation and follow-up validation while minimizing mission disruption.
Maintain dashboards metrics findings status and decision-support reporting needed to demonstrate confidentiality integrity availability and continued authorization
Prepare maintain validate and organize artifacts supporting assessment authorization certification/accreditation Authority to Operate (ATO) and Authority to Connect (ATC) activities.
Coordinate evidence requests control assessments security testing authorization reviews and remediation activities with assessors technical teams program personnel and DHS stakeholders.
Maintain an authorization-ready posture by ensuring artifacts are accurate current internally consistent traceable and aligned with the operational environment.
Respond to DHS cybersecurity investigations data calls and requests for information concerning the GII security posture.
Support compliance reporting and corrective actions arising from security assessments audits vulnerability reviews and Government direction.