Information System Security Representative (ISSR)/Security Control Assessor (SCA)

Company: Guidehouse
Location: Washington
Posted on: March 28, 2020

Job Description:

Job DescriptionOverview: Interested in working with talented people to help develop innovative solutions to some of society's most complex and challenging problems? We are Guidehouse, a leading consulting firm serving the public sector and commercial clients with specialized capabilities in strategy, technology, and risk management. You may not yet know our name, but we have a rich history. Guidehouse is a combination of PwC's former public sector practice and Navigant's deep expertise in energy, financial services and healthcare. We offer an exciting, fast-paced environment that fosters intellectual growth and rewards individuals based on impact, not tenure. Our firm is at the forefront of an emerging model solving complex problems that stretch across government and private companies, affording our people the opportunity to be on the cutting edge of the consulting profession. By focusing on markets facing transformational change, technology-driven innovation, and significant regulatory pressure, our employees also develop and deploy world class knowledge and problem solving that leads to breakthrough solutions. Responsibilities: Guidehouse, LLP is supporting a task order that provides on-site technical and administrative Security Assessment and Authorization (A&A) and Continuous Monitoring (CM) support for the client enterprise wide. The Information Systems Security Engineer (ISSR) implements security control assessment principles to review security requirements, verify implementation, and provide mitigation recommendations throughout the Information Systems' life cycle to facilitate secure systems for A&A and Continuous Monitoring support. The ISSR responsibilities include, but are not limited to: • Serving as the Information Assurance Section subject matter expert for the A&A and Continuous Monitoring processes • Providing security requirements analysis of Information Systems (IS) architectures and designs • Possess a strong understanding IS security controls/requirements and have the ability to provide guidance to the System Owners and System Teams and recommending implementation strategies • Identifying IS vulnerabilities and recommending mitigation alternatives for POA&M items • Reviewing IS security test results to identify weaknesses, technical flaws, and vulnerabilities • Recommending technical process improvements for the A&A process Qualifications: • 5-6 years Information Assurance (IA) and Information Security experience; which includes developing and reviewing security concept of operations, systems security plans, security control assessments, contingency plans, configuration management plans, incident response plans, plan of actions and milestones, risk management plans, vulnerability scanning, and/or vulnerability management plans • 5 years security control assessment experience; which includes systems A&A principles, requirements analysis, system development (software and hardware); network security architecture concepts (topology, protocols, components); and/or IT security principles and methods (firewalls, demilitarized zones, encryption) • Experience with FISMA and RMF/A&A processes • Experience with NIST SP (800-27, 30, 37, 53, 60, 137, 144, 145), FIPS (199, 200), and CNSSI 1253 experience • Experience with STIG and SCAP • Understanding of the System Development Lifecycle • Understanding of network access, identity and access management • Strong analytical, communication, problem solving and leadership skills • Ability to perform in a fast paced environment with frequent change • CISSP (required) and CISM or GSLC; or, ability to obtain CISM or GSLC within 6 months of hire • Active Top Secret clearance with SCI eligibility • Bachelors or Master's degree in a related field Disclaimer: * This position requires successful completion of a background check and employment verification. * The successful candidate must not be subject to employment restrictions from a former employer (such as a non-compete) that would prevent the candidate from performing the job responsibilities as described.

Keywords: Guidehouse, Washington DC , Information System Security Representative (ISSR)/Security Control Assessor (SCA), IT / Software / Systems , Washington, DC