Security Specialist II
A leader in cutting-edge research and technology in the cyber arena, CPMG focuses on using business drivers to guide cybersecurity activities and manage risk.
CPMG offers flexible, integrative solutions for Department of Defense (DoD) contractors, among others, and specializes in cybersecurity, information and operational technology, electronic security surveillance, and support services.
Summary:
As the Security Specialist II, you will assist the Information Systems Security Manager (ISSM) in the development, review, endorsement and maintenance of cyber security certifications and accreditations.
This position will be based in Norfolk, VA supporting the Information Technologies Support Services (ITSS) contract.
Essential Job Functions:
Act as the Information System Security Engineer (ISSE) by providing technical support for the Risk Management Framework (RMF) Assessment and Authorization (A&A) process
Establish RMF Security Plan in eMASS
Ensure proper Architecture, Boundary, and Dataflow diagrams are completed for systems being authorize
Inventory and documentation of hardware/software/firmware within assessment boundary
Develop Continuous Monitoring Strategy
Completion of eMASS Implementation Plan based on Continuous Monitoring Strategy
Ensure 100% execution of the approved Security Assessment Plan
Ensure ACAS automated vulnerability scans are completed on all assets with-in assessment boundary and establish hardened baseline configuration with consistent, repeatable successful results
Ensure system(s) are DISA STIG compliant - through SCAP scripts and manual checks
Maintain the RMF POA&M to accurately portray the risk posture of assigned solutions
Detail all relevant mitigation and remediation activities to vulnerabilities noted on the RMF POA&M through the Change Management Process
Ensure all RMF documentation is updated based on change and vulnerability management efforts
Perform continuous security reviews of RMF Security Controls (per approved continuous monitoring strategy)
Support the development of the Plan of Action and Milestones (POA&M) and the development and update of the Security Authorization Package (SAP)
Assemble all required documentation as outlined by the ISSM for the RMF packages
Assess security controls, Security Technical Implementation Guides (STIGs), and Assured Compliance Assessment Solution (ACAS) scans in accordance with governing policies for servers, networking equipment, workstations, etc.
Process, maintain compliance, and verify completion of ACAS, STIG, and SCAP files, report any open findings or vulnerabilities to the program, propose and implement mitigations as required and construct necessary POA&M when required
Monitor cyber security compliance for all OPTEVFOR systems using tools to include but not limited to the Enterprise Mission Assurance Support Service (eMASS), Vulnerability Remediation Asset Manager (VRAM), and Assured Compliance Assessment Solution (ACAS)
Administer the ACAS server and vulnerability scans
Apply security updates to the ACAS server application and Linux operating system as required.
Assist the ISSM in the development or modification of any policies, plans, and documentation required for the accreditation of all OPTEVFOR systems
Administer and monitor Host Based Security System (HBSS) servers to maintain optimum operating status and install required server and client updates to HBSS components within mandated time-lines
Make approved policy changes to HBSS configuration when required.
Provide a monthly status report which contains the progress of work on assigned tasks and future work plans for the upcoming month#CJNecessary Skills and Knowledge:
Knowledge of handling classified and sensitive but unclassified information
Must possess strong organizational skills, be detailed oriented, and ability to work in a fast-paced environment
Effective interpersonal skills to coordinate efforts and work with other internal and external organizationsMinimum
Qualifications:
Minimum of 5 years Navy Assessment and Authorization (A&A) process experience with Risk Management Framework (RMF).
Minimum of 5 years experience administering the DISA Endpoint Security Solutions (ESS), formerly called Host Based Security System (HBSS) or have successfully completed the Endpoint Security Solutions (ESS) Administrator 201 ePO 5.
10 and Endpoint Security Solutions (ESS) Advanced Administrator 301 ePO 5.
10 courses.
Courses can be completed online at https:
//cyber.
mil/training/ess-201/ and https:
//cyber.
mil/training/ess-301/ />
Experience with monitoring information system security compliance using Enterprise Mission Assurance Support Service (eMASS), Vulnerability Remediation Assurance Manager (VRAM) and Assured Compliance Assessment Solution (ACAS)
Requires a DoD IAM level II or III compliant certification ( https:
//public.
cyber.
mil/wid/cwmp/dod-approved-8570-baseline-certifications/).
for either Certified Authorization Professional (CAP), CompTIA Advanced Security Practitioner (CASP+CE), Certified Information Security Manager (CISM), Certified Information Systems Security Professional (CISSP) or GIAC Security Leadership Certification (GSLC)
Personnel accessing information systems have the proper and current cyber security certification to perform IT privileged administrative functions in accordance with DoD 8570.
01-M (Table AP3.
T1), Cyber Security Workforce (CSWF) Improvement Program.
Contractor personnel who do not have proper and current CSWF certifications shall be denied access to DoD information systems for the purpose of performing privileged user functions and will be dismissed from this contract
Secret Clearance is required
Must be a US Citizen Preferred
Qualifications:
Bachelor's degree in a related field of study Requisition ID:
2023-11848 External Company Name:
Goldbelt, Inc.
External Company URL:
careers-goldbelt.
icims.
com Recommended Skills Administration Architecture Assembly And Installation Asset Management Attention To Detail Certified Information Security Manager Estimated Salary: $20 to $28 per hour based on qualifications.
CPMG offers flexible, integrative solutions for Department of Defense (DoD) contractors, among others, and specializes in cybersecurity, information and operational technology, electronic security surveillance, and support services.
Summary:
As the Security Specialist II, you will assist the Information Systems Security Manager (ISSM) in the development, review, endorsement and maintenance of cyber security certifications and accreditations.
This position will be based in Norfolk, VA supporting the Information Technologies Support Services (ITSS) contract.
Essential Job Functions:
Act as the Information System Security Engineer (ISSE) by providing technical support for the Risk Management Framework (RMF) Assessment and Authorization (A&A) process
Establish RMF Security Plan in eMASS
Ensure proper Architecture, Boundary, and Dataflow diagrams are completed for systems being authorize
Inventory and documentation of hardware/software/firmware within assessment boundary
Develop Continuous Monitoring Strategy
Completion of eMASS Implementation Plan based on Continuous Monitoring Strategy
Ensure 100% execution of the approved Security Assessment Plan
Ensure ACAS automated vulnerability scans are completed on all assets with-in assessment boundary and establish hardened baseline configuration with consistent, repeatable successful results
Ensure system(s) are DISA STIG compliant - through SCAP scripts and manual checks
Maintain the RMF POA&M to accurately portray the risk posture of assigned solutions
Detail all relevant mitigation and remediation activities to vulnerabilities noted on the RMF POA&M through the Change Management Process
Ensure all RMF documentation is updated based on change and vulnerability management efforts
Perform continuous security reviews of RMF Security Controls (per approved continuous monitoring strategy)
Support the development of the Plan of Action and Milestones (POA&M) and the development and update of the Security Authorization Package (SAP)
Assemble all required documentation as outlined by the ISSM for the RMF packages
Assess security controls, Security Technical Implementation Guides (STIGs), and Assured Compliance Assessment Solution (ACAS) scans in accordance with governing policies for servers, networking equipment, workstations, etc.
Process, maintain compliance, and verify completion of ACAS, STIG, and SCAP files, report any open findings or vulnerabilities to the program, propose and implement mitigations as required and construct necessary POA&M when required
Monitor cyber security compliance for all OPTEVFOR systems using tools to include but not limited to the Enterprise Mission Assurance Support Service (eMASS), Vulnerability Remediation Asset Manager (VRAM), and Assured Compliance Assessment Solution (ACAS)
Administer the ACAS server and vulnerability scans
Apply security updates to the ACAS server application and Linux operating system as required.
Assist the ISSM in the development or modification of any policies, plans, and documentation required for the accreditation of all OPTEVFOR systems
Administer and monitor Host Based Security System (HBSS) servers to maintain optimum operating status and install required server and client updates to HBSS components within mandated time-lines
Make approved policy changes to HBSS configuration when required.
Provide a monthly status report which contains the progress of work on assigned tasks and future work plans for the upcoming month#CJNecessary Skills and Knowledge:
Knowledge of handling classified and sensitive but unclassified information
Must possess strong organizational skills, be detailed oriented, and ability to work in a fast-paced environment
Effective interpersonal skills to coordinate efforts and work with other internal and external organizationsMinimum
Qualifications:
Minimum of 5 years Navy Assessment and Authorization (A&A) process experience with Risk Management Framework (RMF).
Minimum of 5 years experience administering the DISA Endpoint Security Solutions (ESS), formerly called Host Based Security System (HBSS) or have successfully completed the Endpoint Security Solutions (ESS) Administrator 201 ePO 5.
10 and Endpoint Security Solutions (ESS) Advanced Administrator 301 ePO 5.
10 courses.
Courses can be completed online at https:
//cyber.
mil/training/ess-201/ and https:
//cyber.
mil/training/ess-301/ />
Experience with monitoring information system security compliance using Enterprise Mission Assurance Support Service (eMASS), Vulnerability Remediation Assurance Manager (VRAM) and Assured Compliance Assessment Solution (ACAS)
Requires a DoD IAM level II or III compliant certification ( https:
//public.
cyber.
mil/wid/cwmp/dod-approved-8570-baseline-certifications/).
for either Certified Authorization Professional (CAP), CompTIA Advanced Security Practitioner (CASP+CE), Certified Information Security Manager (CISM), Certified Information Systems Security Professional (CISSP) or GIAC Security Leadership Certification (GSLC)
Personnel accessing information systems have the proper and current cyber security certification to perform IT privileged administrative functions in accordance with DoD 8570.
01-M (Table AP3.
T1), Cyber Security Workforce (CSWF) Improvement Program.
Contractor personnel who do not have proper and current CSWF certifications shall be denied access to DoD information systems for the purpose of performing privileged user functions and will be dismissed from this contract
Secret Clearance is required
Must be a US Citizen Preferred
Qualifications:
Bachelor's degree in a related field of study Requisition ID:
2023-11848 External Company Name:
Goldbelt, Inc.
External Company URL:
careers-goldbelt.
icims.
com Recommended Skills Administration Architecture Assembly And Installation Asset Management Attention To Detail Certified Information Security Manager Estimated Salary: $20 to $28 per hour based on qualifications.
|
|
 | |
