Cyber Security Continuous Monitoring Supervisor (Supervisor II)

Mission Support and Test Services, LLC (MSTS) manages and operates the Nevada National Security Site (NNSS) for the U.S. National Nuclear Security Administration (NNSA).  Our MISSION is to help ensure the security of the United States and its allies by providing high-hazard experimentation and incident response capabilities through operations, engineering, education, field, and integration services and by acting as environmental stewards to the Site’s Cold War legacy.  Our VISION is to be the user site of choice for large-scale, high-hazard, national security experimentation, with premier facilities and capabilities below ground, on the ground, and in the air. (See NNSS.gov for our unique capabilities.) Our 2,750+ professional, craft, and support employees are called upon to innovate, collaborate, and deliver on some of the more difficult nuclear security challenges facing the world today.   

• MSTS offers our full-time employees highly competitive salaries and benefits packages including medical, dental, and vision; both a pension and a 401k; paid time off and 96 hours of paid holidays; relocation (if located more than 75 miles from work location); tuition assistance and reimbursement; and more.  
• MSTS is a limited liability company consisting of Honeywell International Inc. (Honeywell), Jacobs Engineering Group Inc. (Jacobs), and HII Nuclear Inc.

NNSS is seeking a Continuous Monitoring Team Supervisor (Supervisor II) to lead our Cyber Security Continuous Monitoring program. The candidate must possess the knowledge, skills, and abilities required to lead the continuous monitoring team in conducting continuous monitoring, vulnerability scanning, and remediation operations within an enterprise environment. An ideal candidate will possess professional certifications such as GIAC Enterprise Vulnerability Assessor (GEVA), GIAC Security Essentials (GSEC) and/or Certified Information Systems Security Professional (CISSP) .

Key Responsibilities

• Spearhead the continuous monitoring program across the organization's Information Technology and Operational Technology environments. 
• Build and execute the roadmap for the program, develop metrics to measure the program, and aggressively drive the reduction of risks and vulnerabilities. 
• Enforce continuous discovery, assessment, and remediation status of enterprise-wide assets. 
• Oversee deployment of the monitoring infrastructure and improve visibility across on-premises and cloud infrastructure and endpoints. 
• Develop a strategy to identify and prioritize a repeatable process to mitigate risks in the enterprise. 
• Collaborate with system owners, ISSO's and other teams within the organization's IT division to identify, track, and remediate risks. 
• Assess emergency threats for applicability and work with cross-functional teams to implement countermeasures and reduce the attack surface. 
• Communicate the state of vulnerability management to stakeholders, developers, IT, and business leaders. 
• Build and maintain dashboards that present actionable data to IT teams and IT leadership in an intuitive manner. 
• Oversee the validation and testing of complex compliance audits and vulnerability plugins to ensure accuracy of the scan results. 
• Communicate with the third-party vendors regarding issues with the scanning tools to ensure issues identified during the scanning process are troubleshooted and resolved. 
• Assists with data calls, FISMA reporting, compliance scanning and reporting, continuous monitoring, and compiling reports for auditors. 
• Contribute to an overall productive and respectful work environment by providing excellent customer service and working in a positive, collegial manner. Maintain cooperative and respectful working relationships with Cyber Security staff, other divisions, and other customers. 

• Bachelors' degree or equivalent training and experience in a computer-related field and at least 8 years of related experience. 
• Experience using MITRE ATT&CK framework. 
• Knowledge of vulnerability management and scanning best practices such as CVE database and the CVSS System used for scoring vulnerabilities. 
• Knowledge of network and application security principles such as OWASP Testing Guidelines, OWASP Application Security knowledge framework and ATT&CK framework. 
• Knowledge of DHS Continuous Diagnostic and Mitigations (CDM) tools and reporting structures. 
• Knowledge of scanning best practices for hardware and software asset management. 
• Preferred Additional Qualifications (please upload certificate(s) when applying): 
  • GIAC Enterprise Vulnerability Assessor (GEVA)
  • GIAC Security Essentials (GSEC)
  • Certified Information Systems Security Professional (CISSP) 
• Has command of a broad r