ISSO/ISSM

Location: Oak Ridge, TN

Job Title: ISSO/ISSM Level 5

Organization: Chief Information Security Office

Job Specialty: Cyber Security

Clearance Required: Q or TS

This position is a remote role in Oak Ridge, TN. Some on-site work may be required in this position. If offered the role, relocation assistance will be available.

What You'll Do

The ISSO/ISSM is Responsible for the analysis and development of the integration, testing, operations, and maintenance of systems security. 

Preferred Job Requirements

●      Masterful understanding and management of POAM process.

●      Masterful understanding of classification certification levels such as FISMA High, and Fedramp High.

●      Very familiar with RSA ARCHER as mitigation governance platform for taxonomy and POAM mitigation. 

●    The ISSO/ISSM is responsible for the analysis and development of the integration, testing, operations, and maintenance of systems security.

●    Knowledge of computer networking concepts and protocols, and network security methodologies.

●    Knowledge of Industrial Control System/Supervisory Control and Data Acquisition System threats, vulnerabilities, security controls and methods.

●    Knowledge of laws, regulations, policies, and ethics as they relate to cybersecurity and privacy.

●    Knowledge of cybersecurity and privacy principles.

●    Knowledge of cyber threats and vulnerabilities.

●    Knowledge of specific operational impacts of cybersecurity lapses.

●    Knowledge of encryption algorithms

●    Knowledge of cryptography and cryptographic key management concepts

●    Knowledge of installation, integration, and optimization of system components.

●    Knowledge of vulnerability information dissemination sources (e.g., alerts, advisories, errata, and bulletins).

●    Knowledge of cybersecurity and privacy principles and organizational requirements (relevant to confidentiality, integrity, availability, authentication, non-

repudiation).

●    Knowledge of information technology (IT) security principles and methods (e.g., firewalls, demilitarized zones, encryption).

●    Knowledge of security system design tools, methods, and techniques.

●    Knowledge of software engineering.

●    Knowledge of the systems engineering process.

●    Knowledge of network security architecture concepts including topology, protocols, components, and principles (e.g., application of defense-in-depth).

●    Knowledge of network systems management principles, models, methods (e.g., end-to-end systems performance monitoring), and tools.

●    Knowledge of security models (e.g., Bell-LaPadula model, Biba integrity model, Clark-Wilson integrity model).

●    Knowledge of Personally Identifiable Information (PII) data security standards.

●    Knowledge of information technology (IT) risk management policies, requirements, and procedures.

●    Knowledge of laws, policies, procedures, or governance relevant to cybersecurity for critical infrastructures.

●    Knowledge of configuration management techniques.

●    Knowledge of security management.

●    Knowledge of developing and applying user credential management system.

●    Knowledge of implementing enterprise key escrow systems to support data-at-rest encryption.

●    Knowledge of an organization's information classification program and procedures for information compromise.

●    Knowledge of countermeasure design for identified security risks.

●    Knowledge of network design processes, to include understanding of security objectives, operational objectives, and trade-offs.

●    Knowledge of how to use network analysis tools to identify vulnerabilities.

●    Skill in designing the integration of hardware and software solutions.

●    Skill in developing and applying security system access controls.

●    Skill in evaluating the adequacy of security designs.

●    Skill in assessing security systems designs.

●    Skill in assessing security controls based on cybersecurity principles and tenets. (e.g., CIS CSC, NIST SP 800-53, Cybersecurity Framework, etc.).

●    Skill in recognizing vulnerabilities in security systems. (e.g., vulnerability and compliance scanning).

●    Ability to apply cybersecurity and privacy principles to organizational requirements (relevant to confidentiality, integrity, availability, authentication, non-repudiation)

Specific Requirements – Senior level experience in Security Information and Event Management (SIEM); Senior level experience as an Information System Security Manager (ISSM) and Security Control Assessments