(627) Information Assurance Compliance Specialist II

(627) Information Assurance Compliance Specialist IIPhiladelphia, PAArlo Solutions (Arlo) is an information technology consulting services company that specializes in delivering technology solutions. Our reputation reflects the high quality of the talented Arlo Solutions team and the consultants working in partnership with our customers. Our mission is to understand and meet the needs of both our customers and consultants by delivering quality, value-added solutions. Our solutions are designed and managed to not only reduce costs, but to improve business processes, accelerate response time, improve services to end-users, and give our customers a competitive edge, now and into the future.The Specialist, Information Assurance Compliance II (SIAC2) will support the Naval Surface Warfare Center Philadelphia Division (NSWCPD) Department 40 as contractor staff through Arlo Solutions, serving as a senior cybersecurity compliance specialist providing comprehensive information assurance and Risk Management Framework (RMF) support services for Propulsion, Power & Auxiliary Machinery Systems. This key personnel position focuses on developing, implementing, and maintaining cybersecurity compliance programs and documentation to ensure adherence to Department of Defense (DoD) and Department of Navy (DON) cybersecurity policies and procedures for both afloat and Platform Information Technology (PIT) ashore systems.Work Location: Primary: Philadelphia, PA; periodic travel to customer and operational sites may be requiredClearance: Active Secret security clearanceJob Responsibilities and/or Success FactorsRisk Management Framework (RMF) Development and ImplementationCollect and collate system or site information to evaluate and document security postures in Enterprise Mission Assurance Support Service (eMASS)Develop, submit, and maintain RMF packages in accordance with DoD Instruction , Naval Sea Systems Command (NAVSEA) Business Rules, DON RMF Process Guides, and NAVSEA Standard Operating Procedures (SOPs)Create comprehensive RMF package documentation including Assess Only (AO) Determination Request Packages, System Platform IT (PIT) Determinations, Categorization Forms, Authorization Boundary Diagrams, Defense in Depth Diagrams, Privacy Impact Assessments (PIA), and Security Plans (SPs)Develop and maintain Plan of Action and Milestones (POA&M) for all Information Assurance-related tasks and deliverables in eMASSPolicy and Compliance ManagementDevelop or revise existing policies, plans, and strategy documents to meet requirements for RMF Control FamiliesCreate comprehensive documentation including Incident Response Plans, Contingency Plans, Information Assurance Vulnerability Management Plans, Configuration Management Plans, and Physical Security PlansEnsure all Information Assurance requirements are addressed and compliant with applicable DoD and DON cybersecurity policiesEvaluate discrepancies and recommend potential mitigation measures for reducing or eliminating specific risksAssessment and Evaluation ActivitiesConduct risk and vulnerability assessments of planned and installed systems to identify vulnerabilities, risks, and protection needsExecute Security Assessment Plans (SAPs) by conducting on-site testing for afloat and PIT ashore systemsPerform systems security reviews, audits, and evaluations to ensure accreditation documents accurately represent current risk postureDetermine residual risk of packages based on package content and assessment results for Security Controls Assessor reviewConduct analysis of logs, events, and reporting from various data collection tools including Assured Compliance Assessment Solution (ACAS), Host Based Security Systems (HBSS), Security Information and Event Management (SIEM), firewall systems, and intrusion detection systemsContinuous Monitoring and MaintenanceSupport continuous monitoring activities for authorized systems to maintain Authorization to Operate (ATO) statusDevelop and update required eMASS documents at specified frequencies, including POA&Ms and Risk Assessment Reports (RARs)Determine system compliance with all applicable Controls and Assessment Procedures (APs) for assigned DON systemsMaintain current vulnerability scan data and residual risk POA&Ms in Vulnerability Remediation Asset Manager (VRAM)Track deliverables and action items in accordance with A&A guidanceTechnical Documentation and ReportingPerform detailed technical documentation analysis of software/hardware associated with systems and componentsDevelop system architecture diagrams, software design requirements, network connection/authorization boundary diagrams, and RMF plans/policiesCreate and maintain vulnerability DON eMASS POAMs for systemsPresent and submit data to management, develop comprehensive reports, and produce procedural documentationExecute Security Technical Implementation Guides (STIGs), Security Requirements Guides (SRGs), ACAS scanning, and apply patches to assets to obtain cybersecurity complianceStakeholder Coordination and CommunicationManage, attend, and support configuration control board practicesCoordinate with government personnel, system owners, and other stakeholders throughout the RMF processAssess impacts from observed risks and report via the Cybersecurity Program chain of commandPerform evaluation of system administrator and security engineer proposed corrections to ensure complianceSupport Information Assurance Vulnerability Management (IAVM) activities including remediation, patching, and scanningCompliance and Quality AssuranceEnsure RMF artifacts comply with published Navy, NAVSEA Business Rules, NIST SP-800-37, and SP-800-53 Rev 4 requirementsCreate and verify accuracy of POA&Ms/RARs as identified by vulnerability test resultsEnsure information systems are operated, used, maintained, and disposed of in accordance with security policiesTest systems to verify adequate functionality for mission and project requirementsMaintain security clearance and comply with all security requirements specified in the contractEducation and Minimum QualificationsMust be a U.S. CitizenActive Secret security clearanceTarget Education: Bachelor's degree (Computer Science, Information Technology or related technical degree) from accredited College or UniversityTarget Experience: Four (4) years of professional experience in Information Assurance ComplianceMinimum Certification:Must demonstrate at least one of the followingInformation Assurance Management (IAM)Information Assurance Technical (IAT) Level 2 certifications (acceptable certifications include: CAP, CASP+ CE, CISM, CISSP or Associate, GSLC, CCISO, or HCISPP)Continuing Professional Education RequirementsMaintain current IAM/IAT Level 2 certification with required Continuing Professional Education (CPE) as mandated by certification bodyComplete all required Government mandated training including Antiterrorism Level 1 Awareness, Operations Security (OPSEC), Cybersecurity 101 Training, and other security-related training as specifiedDesired QualificationsExperience with Navy cybersecurity programs and RMF processesFamiliarity with NIST Special Publications and DoD cybersecurity instructionsExperience with eMASS, VRAM, ACAS, and other DoD cybersecurity systemsKnowledge of Navy and DoD organizational structureExperience supporting NAVSEA or other Navy commandsProfessional experience in DoD or Navy environmentsUnderstanding of NAVSEA Business Rules and SOPsAAP StatementWe are proud to be an Affirmative Action and Equal Opportunity Employer and as such, we evaluate qualified candidates in full consideration without regard to race, color, religion, sex, sexual orientation, gender identity, marital status, national origin, age, disability status, protected veteran status, and any other protected status.