Information System Security Officer

Position Summary:

Ensure the appropriate operational security posture for INL National Security Systems (NSS) is maintained to include ensuring implementation of DOE and INL Site cybersecurity policies, practices, and procedures. Work with NSS owners and the NSS Information System Security Manager (ISSM) and serve as advisor on all matters, technical and otherwise, involving security of the NSS.

Essential Job Functions and Responsibilities: (Knowledge, skills, and behaviors required for this position.)

• Conduct audits of INL NSS to ensure compliance with, NIST SP 800-53, CNSSI 1253, DISA Security Technical Implementation Guides (STIG), and NNSA Cybersecurity Service Provider (CSSP) subscriber site requirements.
• Lead and direct the development of NSS accreditation packages (i.e., system security plan, security control assessment, risk assessment, etc.) in accordance with federal directives and the Risk Management Framework (RMF).
• Identify accreditation boundaries and type of accreditation.
• Integrate applicable NSS requirements, controls, and processes into design specifications in accordance with DOE established standards, policies, procedures, guidelines, directives, and regulations and laws (statutes).
• Understand the policies, procedures, and controls required to protect network and telecommunication services and assess technical, operational, and administrative security controls as mandated by RMF standards.
• Lead others in maintaining change control, ensuring configuration management of the NSS to protect the system and data in accordance with technical, operational, and administrative security control requirements.
• Perform a variety of data collection, analysis, reporting and briefing activities associated with security operations and maintenance to ensure that the organizational security policies are implemented and maintained on the NSS.
• Verify cybersecurity awareness training and requirements are current for NSS users based on identified needs and organizational policies and within organizational time frames. Develop NSS training material as needed to support end-user training requirements.
• Coordinate with the appropriate management and security offices to ensure NSS users have the required security clearances and need-to-know authorizations before accessing information systems. Collect and track required documentation for NSS user accounts.
• Provide PKI and Trusted Agent (TA) support. Function as PKI advisory and assistance service support to NSS users. Coordinate with Registration Authorities (RA) and other Trusted Agents to accomplish tasks. Submit and respond to tickets for PKI and TA request.
• Identify, categorize, investigate, isolate, assess, and report NSS cybersecurity incidents in coordination with other organizations. Coordinate with the appropriate security offices to ensure that physical controls are implemented as required.
• Participate in the creation, review, and assessment of policies and procedures supporting the secure use and operation of INL information systems that includes, but is not limited to, system security plans, vulnerability management, risk management, configuration management, change management, and others.
• Recommend and implement improvements in cybersecurity controls.
• Work in collaboration with system owners, Information System Security Engineers (ISSE), and Information System Security Managers (ISSM). Serve as an advisor on all matters, technical and otherwise, involving security of assigned information systems.
• Establish and maintain communication channels with stakeholders.
• Review existing and proposed policies with stakeholders.
• Promote awareness of cyber policy and strategy as appropriate among management and ensure sound principles are reflected in the organization's mission, vision, and goals.
• Interpret and apply applicable laws, statutes, and regulatory documents and integrate into policy.
• Support the ISSM in the formulation of classified cyber-related policies.
• Other duties as assigned.

Education, Credentials, and Work Experience:

Required

• Level 3: Bachelor of Science degree in technical field including Computer Science, Information Technology, Cybersecurity or related field and 5 years of relevant experience; or a Master's in a technical field and 2 years of relevant experience; or 11 years of relevant experience in lieu of a degree.
• Level 4: Bachelor of Science degree in technical field including Computer Science, Information Technology, Cybersecurity or related field and 9 years of relevant experience; or a Master's in a technical field and 6 years of relevant experience; or 15 years of relevant experience in lieu of a degree.
• Relevant experience commensurate with level.
• Must be a US Citizen and hold an active DOE "Q" clearance (or DOD/DOJ equivalent)
• Strong analytical and problem-solving skills.

Preferred:

Relevant certifications: Certified Information Systems Auditor (CISA), Certified Information Systems Security Professional (CISSP), Certified Information Security Manager (CISM), Security+
Direct experience working in a classified environment

Physical Requirements:

While performing the duties of this classification, the employee is frequently required to stand, walk, sit, stoop, kneel, bend, use hands to handle materials, manipulate tools, keyboard and type, reach with hands and arms, and operate job-related equipment. The employee must occasionally lift and/or move up to 30 pounds. Sufficient visual acuity and hearing capacity to perform the essential functions and interact with people is required. Reasonable accommodations may be made to enable individuals with disabilities to perform the essential functions..

Working Conditions:

The work environment is an office environment which may include stairs. The noise level is generally moderate; however, may be exposed to loud noises on occasion. Position requires working more than 8 hours/day, irregular hours, and working alone.

The above statements are intended to describe the general nature and levels of work being performed by people assigned to this classification. They are not intended to be construed as an exhaustive list of all responsibilities, duties and skills required of personnel so classified.

Security and Privacy Language:
This position includes information security and privacy responsibilities as defined by NIST SP 800 53, OMB Circular A 130, and DOE Order 206.1A. Position must complete initial and annual role-specific training as required. The incumbent must sign and comply with all required access agreements prior to being granted access to organizational systems or data. Comply with all applicable information security and privacy policies and procedures by following established protocols, with an understanding that non-compliance may result in sanctions.

Level Definers

EX3 - Career:

• Knowledge: Complete understanding and wide application of principles, theories, and concepts in field of specialization. General knowledge of other related disciplines. Resolves a wide range of issues in creative ways. This level is fully qualified, career oriented.
• Problem Solving: Works on problems of diverse scope. Demonstrates good judgment in selecting methods and techniques for obtaining solutions. Solutions are imaginative, thorough, practical, and consistent with organizational objectives.
• Discretion and Latitude: Works under only general direction. Normally receives little instruction day-to-day. Independently determines and develops approach to solutions. Work is reviewed upon completion for adequacy in meeting objectives.
• Impacts: Contributes to completion of specific programs and projects. Failure to obtain results or erroneous decisions or recommendations would typically result in program delays.
• Liaison: Frequent internal organizational customer contacts. May have some outside contact or represent organization in providing solutions to difficult issues associated with specific projects or work.
• Education/Experience: Bachelor's and 5 years. Master's and 2 years. PhD and 2 years.

EX4 - Senior:

• Knowledge: Technical leader with a high degree of knowledge in the overall field and recognized expertise in specific areas. Has wide-ranging experience. Uses professional concepts and company objectives to solve complex issues in creative and effective ways. Interfaces with and mentor junior staff.
• Problem Solving: Works on complex issues where analysis of situations or data requires an in-depth evaluation of variable factors. Exercises judgment in selecting methods, techniques, and evaluation criteria for obtaining results.
• Discretion and Latitude: Work is performed without appreciable direction. Determines methods and procedures on new assignments and may coordinate activities of other personnel (Lead). Exercises considerable latitude in determining objectives of assignment.
• Impacts: Guides the successful completion of major programs and may function in a project leadership role. Erroneous decisions or recommendations would typically result in failure to achieve organizational objectives.
• Liaison: Represents organization as prime contact on projects or work. Interacts with senior internal personnel on significant matters often requiring coordination between organizations. Networks with key contacts outside own area or expertise.
• Education/Experience: Bachelor's and 9 years. Master's and 6 years. PhD and 4 years.