Cyber Risk Management Specialist

Job Summary

Required Qualifications

• •Ability to obtain a U.S. government Security Clearance
• •Master's Degree and 6 year of cyber and FISMA experience
• •Bachelor's Degree and 8 years of cyber and FISMA experience
• •No degree and 12 years of experience, 10 of which must be in cyber and FISMA
• •Possesses at least one professional certification: CISSP, CASP, CISA, CISM or GSLC
• •Must be able to be flexible and adaptive to a fast-paced, fluid business environment
• •Must have a solid grasp on confidentiality, integrity, and availability (CIA) security concepts
• •Must have the ability to efficiently learn and adapt to rapidly changing federal governance frameworks and standards of practice
• •Must have in-depth knowledge of the program's cyber security hygiene
• •Must have knowledge of DevSecOps
• •Must have knowledge of Risk Management Framework (RMF)
• •Must have knowledge of Assessment and Authorization (A&A)
• •Must have knowledge of Federal Risk and Authorization Management Program (FedRAMP) compliance
• •Must have knowledge of continuous ATO (cATO)
• •Must have knowledge of continuous monitoring
• •Must have a grasp on technical implementation and enforcement of security hardening
• •Must have knowledge of vulnerability management
• •Must have knowledge of scan analysis
• •Must have knowledge of data analysis for metrics reporting
• •Must have knowledge of cloud environments
• •Must have knowledge of compliance with Federal regulation and policy
• •Must have knowledge of commercial best practices relating to cyber security
• •Must have strong procedural knowledge of NIST SP 800-37 Risk Management Framework (RMF) for Information Systems and Organization
• •Must have knowledge of NIST SP 800-53 Security and Privacy Controls for Information Systems and Organizations
• •Must have knowledge of NIST SP 800-137 Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
• •Must have knowledge of FedRAMP requirements
• •Must have knowledge of cloud cybersecurity architecture
• •Must have knowledge of risk treatments for modern and emerging technologies (e.g, AI, blockchain, microservices)
• •Must be able to Integrate security into DevOps effectively at every stage of the software development life cycle (SDLC)
• •Must be able to Identify security holes and potential breaches, work through multifaceted security issues, and create effective solutions based on understanding of risk posture and treatments
• •Must be able to Develop and implement tactical strategies for seamless automation to optimize the IT infrastructure
• •Must have specialized knowledge of financial audit standards, classified system IA requirements, and Privacy Act requirements
• •Must be able to Implement the NIST Special Publication (SP) 800 family of publications, particularly those associated with the Risk Management Framework
• •Must be able to Evaluate system, network, or infrastructure security controls against requirements such as FISMA, FIPS, and NIST guidelines
• •Must have in-depth, hands-on knowledge of the FedRAMP regulations, process, and requirements to lead project and initiative teams in accrediting cloud products and services
• •Must be able to Support external audits, data calls, and the Authorization to Operate (ATO) process by coordinating with organization system owners, engineers, CSP's and Third-Party Assessment Organizations (3PAO)
• •Must be able to Positively impact the organization's goals and operational mission through various forms of metric performance measuring tools used to evaluate adherences to compliance
• •Must be able to Advise clients on FedRAMP requirements and provide security guidance on the implementation of security compliance controls per technical, management, and operational requirements
• •Must be able to Implement, monitor, and assess NIST SP 800-53 security controls for cloud environments to ensure compliance with FedRAMP requirements and governance models
• •Must ensure ongoing compliance with FedRAMP policy and requirements through monthly deliverables, regular vulnerability scanning, penetration testing, contingency testing, and annual security assessments performed by a 3PAO
• •Must be able to Support ATO, cATO, and continuous monitoring activities to include security documentation, audit log, security incidents, and risk assessment
• •Must be able to Review and manage Plan of Action & Milestones (POA&M), to include remediation tracking and reporting

Desired Qualifications

• •Experience in FISMA, cloud cybersecurity architecture, compliance with Federal regulation and policy, and commercial best practices relating to cloud security
• •Experience in Information Security processes to include RMF, FedRAMP, Compliance, Continuous Monitoring, and Annual Assessments
• •Certifications in one or more of the following: CISSP, CRICS, CCSP, CAP/CGRC
• •Certifications in one or more of the following: AWS Certified Solutions Architect, AWS Certified Security, Microsoft Certified Solutions Architect, MCSE Cloud Platform and Infrastructure
• •Experience conducting assessments in a 3PAO, C3PAO, or risk auditing organization
• •Experience supporting systems in Agile environments