We are seeking a Cloud Information Systems Security Engineer (ISSE) to implement security engineering principles to review security requirements, verify implementation, and provide mitigation recommendations throughout the cloud life cycle to facilitate secure systems for A&A and Continuous Monitoring support.
Location: Quantico, VA
The Cloud ISSE responsibilities include, but are not limited to:
- Serving as the Information Assurance Section cloud subject matter expert for the A&A and Continuous Monitoring processes
- Providing security requirements analysis of cloud architectures and designs
- Identify cloud architecture development best practices
- Identifying technical gaps and providing solution recommendations for cloud services acquisition, development, migration, implementation, and monitoring
- Explaining cloud security controls/requirements and guidance to the System Owners and System Teams and recommending implementation strategies
- Identifying cloud vulnerabilities and recommending mitigation alternatives for POA&M items
- Reviewing cloud security test results to identify weaknesses, technical flaws, and vulnerabilities
- Reviewing cloud SLAs for compliance to requirements
- Recommending technical process improvements for the A&A process
- Represent the client as the cloud consulting SME
Required Qualifications:
- Ten years IA and InfoSec experience; which includes developing and reviewing security concept of operations, systems security plans, security control assessments, contingency plans, configuration management plans, incident response plans, plan of actions and milestones, risk management plans, vulnerability scanning, and/or vulnerability management plans
- Five years security engineering experience; which includes systems engineering principles, requirements analysis, system development (software and hardware); network security architecture concepts (topology, protocols, components); and/or IT security principles and methods (firewalls, demilitarized zones, encryption)
- Two years cloud experience; which includes cloud security design, requirements analysis, control implementation, mitigation, and FedRAMP, GovCloud as well as experience with common service providers, such as AWS, Azure, and/or Salesforce
- Experience with FISMA and RMF/A&A processes
- Experience with NIST SP (800-27, 30, 37, 53, 60, 137, 144, 145), FIPS (199, 200), CNSSI 1253 experience
- Experience with STIG and SCAP
- Understanding of the System Development Lifecycle
- Understanding of network access, identity and access management
- Strong analytical, communication, problem solving and leadership skills
- Ability to perform in a fast paced environment with frequent change
- CISSP
- Active Top Secret clearance, periodic review (PR) performed within the past three years, SCI eligibility
Preferred Qualifications:
- Government consulting experience
- CISSP-ISSEP, CCSP, GCIA, CEH, GPEN, OSCP or other related certifications
- Knowledge of CSA guidance
- Experience with VMware
- Experience with cloud automation tools and scripting (Python, Java, Chef, Puppet, and/or Ansible)
- Bachelor’s or Master’s degree in a related field
If you are interested please forward your resume to Pamela @ pdraviczki@hta-inc.com
