Information Assurance Engineer (hybrid) from ALTA IT Services

• Candidate shall have a technical background and have a thorough understanding of federal security requirements and guidelines (e.g., 800-53 Rev 5 and M-22-09) and be able to clearly explain how each control should be implemented using industry’s best practices.
• Be responsible and accountable for the security well-being of IT operating environments and must be able to proactively manage security compliance and collaborate with system owners, developers, and other stakeholders to ensure secure system design and operation.
• Independently conduct regular security assessments and audits and provide documented assessment results and recommendations to the senior management team.
• Develop, update, and maintain security documents including System Security Plans (SSPs), Risk Assessment, PTA/PIA and other security documentation.
• Develop management level security reports and presentation, and present security status to customer stakeholders on a regular basis.
• Familiarity with Cyber Security Assessment and Management (CSAM), including POAM management and maintenance of controls under NIST SP 800-53 Rev. 5.
• Develop incident response exercise scenarios and lead the execution of the exercise.
• Lead incident response team and conduct investigations in the event of a security breach.
• Lead security authorization activities in compliance with FISMA and federal agency’s security authorization requirements.
• Lead Continuous Monitoring in the hybrid multi-cloud environment for potential security threats and vulnerabilities.
• Stay updated with the latest security trends, threats, and mitigation techniques.

• Independently use security tools such as Tenable Nessus and web security scanners to conduct security scans, analyze results and identify false positives vs. risks.
• Evaluates security solutions to ensure they meet security requirements for processing sensitive and PII data.
• Coordinate with the agency CISO and other security personnel to enhance the security posture of the environment.
• Perform and/or review technical security assessments of computing environments to identify points of vulnerability, non- compliance with established Information Assurance (IA) standards and regulations and recommend mitigation strategies.
• Validate and verify system security requirements definitions and analysis and establishes system security designs.
• Design, develop and integrate IA and security systems and system components including those for networking, computing, and cloud environments.
• Assist architects and systems developers in the identification and implementation of appropriate information security functionality to ensure uniform application of Agency security policy and enterprise solutions.
• Contribute to the security planning, assessment, risk analysis, risk management, certification and awareness activities for system and networking operations.

• Bachelor’s degree in Cybersecurity, Information Technology, Computer Science, or closely related field of study.
• Minimum 7 years of experience in federal information system security as ISSO, security lead or security engineer for complex systems.
• Excellent written and oral communications skills.
• Candidates will be evaluated on proficiency of oral presentation development and presentation skills, and technical documentation written skills. Candidates might be required to submit sample written document and presentation.
• Active certifications such as CISSP, CISA, CISM or CCSP are required (certifications will be verified).
• Ability to obtain a government security clearance.
• Solid understanding of the Federal Information Security Modernization Act (FISMA), OMB regulations and NIST security standards.
• Proven experience in risk management, and hands-on experience in identifying, analyzing, monitoring, and mitigating risks.
• Proficiency in vulnerability management, including patch management, regular system scanning, and mitigation.
• Strong background in ensuring the security of cloud-based and traditional hosting environments, with a focus on achieving FISMA and FedRAMP compliance.
• Cloud security knowledge in AWS and Azure.
• Capability of handling parallel tasks according to priorities in a fast-paced IT environment.

• DMV location is preferred
• Incident response experience
• Hands-on experience on Windows, Linux and networking platforms
• Experience deploying and customizing security tools to address threats and lower risk: vulnerability scanners, static analyzers, web application firewalls, IDS/IPS, malware analysis, network traffic flow and packet analysis, cloud security posture management (CSPM), etc.
• Knowledge of networking and web protocols (TCP/IP, HTTP, TLS, REST)
• Understanding of modern cloud technology components and deployment patterns: virtual machines, containers, Kubernetes, serverless, infrastructure as code, etc.

#M2