Cybersecurity Advisor

General Duties

• Implement the Network Services Information Assurance Program, ensuring security controls function correctly.
• Standardize templates, processes, and policies in alignment with NIH and HHS guidance.
• Participate in NIH and CIT security working groups.
• Lead development and maintenance of security documentation including POA&Ms and waivers.
• Conduct annual risk assessments, security impact analyses, and support incident response.
• Oversee ATO-related activities for Network Services.
• Maintain technical security documentation including SSPs, architecture diagrams, and data flows.
• Conduct continuous monitoring, vulnerability assessment, and compliance reviews.
• Manage and track remediation activities and waiver documentation.

Deliverables

• Conduct assessments of controls Ensure the implementation and maintenance of security controls in accordance with the SSP and agency policies
• Collaborate with Technical SME (Subject Matter Experts) to capture requirements
• Maintain system information security compliance
• Conduct review of accounts; deactivating unused, active departing employee accounts
• Produce weekly, monthly and quarterly status reports
• Support agency audits on behalf of Network Services and provide required evidence
• Review cybersecurity posture and operational dashboards
• Communicate noteworthy risks or threats to the program and customer executives
• Lead coordination meetings with security teams and stakeholders.
• Oversee modernization and cloud-related security tasks.
• Establish standards and metrics for cybersecurity reporting.
• Participate in governance committees.
• Conduct quarterly risk register reviews.
• Oversee testing activities including penetration tests.
• Support annual enterprise risk assessments and updates to governance materials.

Required Skills

• BS degree in Computer Science, Information Systems or equivalent experience (15+ years)
• Must have one or a combination of the following certifications: Security+, CAP, CISSP, CISA, CEH
• Have in-depth knowledge of Federal security policies, standards, guidelines, and NIST frameworks
• Experience in requirements analysis, mitigation and control implementation
• Must have the ability to obtain a Public Trust

Desired Skills

• Experience with FISMA, RMF, and the NIST SP 800 series.
• Hands-on vulnerability management experience.
• Project management experience
• Ability to produce high-quality deliverables and manage deadlines.
• Strong analytical and communication skills.
• Ability to work independently and collaborate with diverse teams.