СШАFedRAMP Information Security System Officer
21 ч. назад
120k–165k USD / годСШАSeniorHybrid
fedrampnistrisk management frameworkinformation securitycloud security
Responsible for establishing, implementing, and maintaining information security policies and procedures to ensure cloud-native system security and compliance with FedRAMP and RMF standards.
Обязанности
- The Information Systems Security Officer (ISSO) is responsible for establishing, implementing, and maintaining information security policies, standards, and procedures to ensure the confidentiality, integrity, and availability of cloud-native information systems.
- The ISSO will work through either the FedRAMP authorization process and/or the Risk Management Framework (RMF) Steps 1-6 to initially obtain and thereafter maintain necessary Interim Authority to Test (IATT)/Authority to Operate (ATO) decisions for Cloud-Based systems from the Cognizant Authorization Officials (AO) for systems rated to DoW Impact Level 5 (IL5) standards.
- The ISSO must adhere to CNSSI 1253, NIST SP 800-53, NIST SP 800-60, and other Federal Regulations to build out policies and procedures that enforce an effective, secure, and compliant Information Security Program, working closely with the ISSM and FSO in these efforts.
- Security Policy Development and Implementation : Develop and enforce information security policies, standards, and procedures in accordance with CNSSI 1253, NIST SP 800-53, and other applicable Federal regulations.
- Ensure that security policies are up-to-date and reflect current threats and vulnerabilities.
- Risk Management and Assessment : Conduct regular risk assessments and vulnerability assessments to identify potential security threats.
- Implement risk mitigation strategies and manage the risk management framework.
- Compliance and Audit Management : Ensure and maintain IATT and ATO requirements through the RMF Steps.
- Prepare for and execute formal assessments with Government Security Control Assessors in support of achieving and maintaining ATOs.
- Exercise Continuous Monitoring of employed security controls to ensure comprehensive and effective implementation over time.
- Incident Response and Management : Develop and maintain an Incident Response Plan, partnering with Government Customers/Prime/Subcontractors for reporting procedures.
- Lead incident response activities, including investigation, containment, and remediation of security incidents.
- Investigate and adjudicate SIEM events.
- Security Training and Awareness : Develop and conduct security training and awareness programs for Users on classified Information Systems.
- Ensure all personnel are aware of their security responsibilities and understand the importance of maintaining security standards.
- System Security Plans (SSPs) : Create and maintain System Security Plans, collecting all required artifacts (Compliance and Vulnerability reports, documented Policies/Procedures, etc.)
- Ensure that SSPs are regularly reviewed, updated, and compliant with regulatory requirements.
- Build out environmental Security Control Traceability Matrices (SCTM) and Customer/Shared Responsibility Matrices (C/SRM) of implemented security controls
- Collaboration and Communication : Work closely with IT System Admins, compliance, and other departments to ensure cohesive and comprehensive security strategies.
- Serve as a point of contact for security-related issues and provide guidance and support to other teams.
- Continuous Improvement : Stay up-to-date with the latest security trends, technologies, and regulatory requirements.
- Continuously improve security measures and processes to protect information systems effectively.
Требования
- Due to U.S. Government contractual requirements, this position requires eligibility for a U.S. Government security clearance. U.S. citizenship is required to obtain a security clearance; therefore, candidates for this position must be U.S. citizens. An active security clearance is preferred but not required at the time of hire. However, obtaining and maintaining a security clearance may be required in the future based on program needs.
- Certifications : Must have IAT Level II Certification (CompTIA Sec+ or Comparable) or preferred IAT Level III (CISSP, CISM, or Comparable).
- 5+ years of experience in information security with RMF or FedRAMP authorizations.
- Proven experience in leading the management and implementation of an Information Security Program.
- Education: Preferred Bachelor’s degree in Information Security, Computer Science, or a related field.
Другое
- builds modern, cloud-native satellite mission operations software with a simple mission: to operate satellites like servers. Our platform replaces fragmented, legacy ground systems with an integrated, automation-driven approach that brings modern software velocity to space operations.
- We're a small, fast-moving team with deep aerospace and software roots, energized by big challenges and motivated by the impact we have on real missions in this next chapter of the Space Age. If you want to work with sharp, ambitious people who push boundaries, move quickly, and are excited to take space operations to the next level, is the place to do it.
- Strong understanding of security frameworks and standards for RMF, CNSSI, and NIST.
- Proficiency in security tools and technologies, such as SIEM, IDS/IPS, STIG Hardening, and vulnerability management solutions.
- Exposure to technologies and concepts including Kubernetes Containerization, AWS Cloud Tooling, CI/CD pipelines, and Secure Network Architecture.
- Excellent communication and interpersonal skills.
- Strong analytical and problem-solving abilities.
- Ability to manage multiple projects and priorities in a fast-paced environment.
- We work in a cutting edge industry and you will get the opportunity to be part of a small team with a large direct impact on the success of our customers’ space missions!
- We take work life balance very seriously. We require employees to take 15 days off but provide unlimited PTO and follow most US federal government holidays.
- Mental health is just as important as physical so we provide quarterly health & wellness benefits.
- Comprehensive health insurance for you and your family with 100% coverage for employees.
- We encourage employees to save for retirement and provide 4% 401(k) matching.
- Each year we have a 4-day company offsite. Previous locations include San Francisco, Nashville, Denver, Santa Fe, New Orleans, San Diego, Bozeman, and New York City.
- Our culture and company is evolving. You will be key in creating the next major or minor version!