Bering-Alaka`ina Holdings, LLC has a potential need for an
Information System Security Manager (ISSM) to provide support for our government customer in
San Antonio, TX.
DESCRIPTION OF RESPONSIBILITIES:- Provide ISSM cybersecurity support for NIPRNet, DREN, RDTE, SIPRNet, and standalone enclaves/systems.
- Formally validating and verifying that all administrative and technical personnel meet the baseline certification and training requirements of DoD 8140 prior to granting elevated system access, administering and maintaining signed Privileged Access Agreements (PAAs); and conducting recurring audits of all privileged accounts.
- Serve as a cybersecurity consultant for unit technicians.
- Perform tasks necessary to administer, coordinate and track compliance with TSRL enterprise cybersecurity architecture, strategy, plans, and supplemental policy for the entire organization.
- Ensure Risk Management Framework (RMF) requirements are met, Authority to Operate (ATO) is granted and remains valid, all security-related documentation is kept up-to-date, and supported units have a reliable team of cybersecurity experts.
- Assist in configuration management process reviews and maintenance to ensure appropriate secure mechanisms are in place, update RMF requirements, and support internal and external entity audits and inspections.
- Perform data entry, monitoring, and provide assistance to maintain data and database organization structures within the IT portfolio in the Information Technology Investment Portfolio System (ITIPS), the RMF workflow and Enterprise Mission Assurance Support Service (eMASS) systems.
- Achieve and continuously maintain the Authorization to Operate (ATO) for TSRL, related subsystems; NIST 800-53, Rev 5, Security and Privacy Controls for Federal Information Systems and Organizations; Committee on National Security Systems Instruction No. 1253 (CNSSI 1253, Rev 4), Security Categorization and Control Selection for National Security Systems; DODI 8510.01, Risk Management Framework for DoD Systems; and DISAI 270-50-9, Life Cycle Sustainment Planning, among other risk management framework directives.
- Advise senior management and Authorizing Official on risk levels, security posture, and changes affecting the organization's cybersecurity posture.
- Assess threats to and vulnerabilities of computer systems/enclaves to develop a security risk profile. Shall conduct technical risk assessments to identify, document, and mitigate vulnerabilities across computer systems and enclaves.
- Collect and maintain data needed to meet system/enclave cybersecurity reporting. Shall maintain a digital eMASS system package repository on the authorized Information System (IS).
- Administer and track all relevant systems/enclaves within Enterprise Mission Assurance Support Service (eMASS) and ensure the ATO is current.
- Prepare, distribute, and maintain plans, instructions, and standard operating procedures (SOPs) concerning system security, for example; Body of Evidence documents, System Security Plans, Security Assessment Reports (SAR), Plan of Actions and Milestones (POAM), risk assessment reports, topology diagrams, software lists, and hardware list.
- Ensure plans of action and milestones or remediation plans are in place for vulnerabilities identified during risk assessments, audits, inspections, etc.
- Maintain artifacts specified within the ATO/eMASS package such that they can be inspected semi-annually and any changes to ATO required documentation must be uploaded as an artifact in eMASS within three (3) business days.
- Maintain system hardening checklists (STIGs) and implement documented remediation plans (fix-actions) to resolve findings from official cybersecurity audits and inspections.
- Support cybersecurity inspections and audits by internal and external Government agencies, as necessary.
- Coordinate with the TSRL IT lead to implement changes within eMASS; implement, assess, manage, and monitor eMASS security controls and eMASS assessment procedures (APs); shall ensure precautions are in place such that other team members' eMASS data is not erroneously overwritten.
- Utilize Assured Compliance Assessment Solution (ACAS), or other AF-approved scanning software, to accomplish audit controls and interpret vulnerability scanner results to identify vulnerabilities.
- Conduct application vulnerability assessments and perform technical and non-technical risk and vulnerability assessments of relevant technology focus areas to include applications/software.
- Ensure implementation of Information Assurance Vulnerability Management (IAVM) dissemination, reporting, and compliance procedures.
- Apply cybersecurity strategy to cloud computing service and deployment models.
- Perform applicable training and ensure cybersecurity training requirements have been satisfied by all TSRL users for continued network access.
- Execute logical system access onboarding and offboarding programs, for example maintaining up-to-date Standard Operating Procedures (SOPs) for the submission and routing of DD Form 2875s, and serving as the central coordinator for all organizational accounts.
- Schedule and complete quarterly destruction of media in accordance with AF and local policies.
- Attend in-person or virtual cybersecurity-related meetings, as required, and provide meeting minutes to support RMF requirements.
- Collaborate in system discovery and unit discussions to categorize systems for entry into eMASS, engineer compliant cybersecurity solutions, and develop organizational security policies. Shall assist with all hardware and software entry/exit requirements pertaining to TSRL, as dictated by policy.
- Assist with managing all TSRL Memorandums of Agreement (MOA), Memorandums of Understanding (MOU), and Acknowledgement of Responsibility (AOR) Letters between the division and external customers for the RMF Accreditation Program. Shall assist in updating these documents annually and conduct complete reviews every three (3) years. Shall courier classified equipment or media to approved destinations throughout TSRL in accordance with applicable security regulations.
- Other duties as assigned by Supervisor.
REQUIRED DEGREE/EDUCATION/CERTIFICATION:- Bachelor of Science Degree in Information Technology or Cybersecurity.
- Must meet all required certifications for DoD 8140. (CASP+; CISSO; CCSP; SEC+)
REQUIRED SKILLS AND EXPERIENCE:
- Minimum of five (5) years of experience working Risk Management Framework (RMF) requirements and providing cybersecurity services with no more than 3 consecutive years of lapse in cyberspace work.
- Must have a Security + certification that is valid.
- Must be willing to sign a non-disclosure agreement.
REQUIRED CITIZENSHIP AND CLEARANCE: and VISA holders are not eligible.- Must have an active SECRET clearance.
Bering-Alaka`ina Holdings, LLC is a fast-growing government service provider. Employees enjoy competitive salaries. Eligible employees enjoy a 401K plan with company match; medical, dental, disability, and life insurance coverage; tuition reimbursement; paid time off; and 11 paid holidays.
We are an Equal Opportunity/Affirmative Action Employer of individuals with disabilities and veterans. We not illegally discriminate in employment decisions on the basis of any protected categories. If you are a person with a disability and you need an accommodation during the application process, please click here to request accommodation. We E-Verify all employees.
As a part of BSNC, Bering- Alakaina Holdings gives hiring, promotion, training, and retention preference to BSNC shareholders, descendants and shareholder spouses who meet the minimum qualifications for the job. Qualified job candidates will generally be considered in the following order: BSNC shareholders, descendants, shareholder spouses, current employees, and outside candidates. The BSNC Shareholder Development department tracks and monitors the implementation of the Shareholder Hire Preference across its operations.Bering-Alaka`ina Holdings, LLC is comprised of industry-recognized government service firms designated as Alaska Native Corporation (ACN)-owned and 8(a) certified businesses and includes Ke`aki Technologies, LLC; Laulima Government Solutions, LLC; K?pono Government Services, LLC; Kapili Services, LLC; Po`okela Solutions, LLC; K?kaha Solutions, LLC; and Pololei Solutions, LLC.
For additional information, please visit ;br>
#LI-JS1
#ClearanceJobs
