Information Security System Engineer (ISSE) Analyst

Founded in 2003, IT Concepts’ core values – customer-centricity, teamwork, driven to deliver, innovation, and integrity – ensure we work together to be the best, realize objectives, and make a positive impact in our communities. We intentionally created and sustain our ITC culture that embraces change, experimentation, continuous learning, and improvement. We bring our design thinking problem-solving approach that challenges assumptions, prioritizes curiosity, and invites complexity to deliver innovative, efficient, and effective solutions. As we continue to grow in the support of our government customers, we are looking for driven and innovative individuals to join our team.

IT Concepts, INC. (ITC) is seeking an Information Security System Engineer to become a vital part of our team and offer invaluable support to the Social Security Administration’s Information System Security Officer (ISSO) and the Office of Information Security (OIS) in coordinating and assessing the protection of SSA information and information management assets. We are looking for a candidate who possesses not only a profound grasp of the NIST Risk Management Framework (RMF), but also a wealth of experience in evaluating risk, based on the RMF, and effectively communicating feedback to stakeholders. Additionally, a solid understanding of the NIST Cybersecurity Framework (CSF) version 2.0 is crucial.

Location: Hybrid (As requested)

Responsibilities:

The ISSE Analyst will undertake an agile approach to provide proper Risk Management Framework (RMF) activities and ensure executives can make effective cyber decisions. Key responsibilities include:

• Creating new documentation and updating existing documentation with the input from appropriate stakeholders utilizing SSA’s GRC tool following the appropriate steps in the Risk Management Framework. Desired artifacts include but are not limited to: Federal Information Processing Standards (FISP) 199, Business Impact Analysis (BIA), Information System Contingency Plan (ISCP), Configuration Management Plan (CMP), and System Security Plan (SSP).
• Work with stakeholders to understand and sign ATO documentation.
• Supporting the ISSO to develop a standardized and detailed methodology to transition from NIST SP 800-53 Rev. 4 to NIST SP 800-53 Rev. 5 for compliance, identifying dependencies and prioritizing transition efforts.
• Train ISSO team on acceleration tool use and project plan expectations.
• Provide guidance outlining Common Control Provider (CCP) qualification and assist ISSO team and stakeholders in updating.
• Identify CCP gaps and overlaps, while clarifying qualifications for what should be a CCP.
• Update documentation to allow non-security personnel better understanding of control inheritance selection.
• Expand ISSO toolset and capabilities to keep system stakeholders engaged during the ATO process.
• Escalate issues or decisions such as overdue POMS, upcoming assessments, and major security changes.
• Provide ISSO program refinement by recommending areas for standardization to ensure ISSO quality of services and approach for supporting stakeholders is predictable and measurable while reducing the number of single points of failure.
• Publish updated guidance and tools for regular use to standardize ISSO approach to ATO support efforts and allow seamless collaboration including any specialized training.
• Provide regular updates as part of status reporting.

Requirements

• Bachelor's degree in Computer Science, Information Technology, or a related field.
• 2+ years of experience in risk management and completing systems assessments, preferably in the cybersecurity domain.
• Deep understanding of the NIST SP 800-37 Risk Management Framework and NIST SP 800-53 Security and Privacy Controls for Information Systems and Organizations Rev.4 and Rev. 5 updates.
• Experience conducting Security Control Assessments.
• Knowledge of Federal level Information Security Policies and Requirements (e.g. OMB, NIST, FISMA, FedRAMP, HIPAA, etc.), laws, regulations, policies and ethics as they relate to cybersecurity and privacy.
• Excellent written and verbal communication skills.
• Knowledge of cyber threats and vulnerabilities.
• Ability to effectively communicate technical cybersecurity concepts to non-technical stakeholders, including leaders of federal agencies.
• Ability to author system security plans with minimal oversight while gaining feedback from stakeholders.
• Skills in preparing drafts, technical reports, plans and related cor