Security Control Assessor - TS/SCI with Polygraph

HOW A SECURITY CONTROL ASSESSOR WILL MAKE AN IMPACT

• Provide documentation to Customer which describes all identified system risks, planned test procedures taken, and test results 

• Provide enhancement capabilities and Standard Operating Procedures (SOPs)  to assessment operations for execution and implementation 

• Maintain accountability to endure integrity and confidentiality of the assessment process 

• Provide analysis of vulnerabilities and exploitations

• Review and make recommendations on program-level documentation (e.g., requirements specification, system architecture, design documents, test plans, security plans, etc.) 

• Develop and document security evaluation test plan and procedures 

• Assist in researching, evaluating, and developing relevant Information Security policies and guidance 

• Actively participate in or lead  Technical Exchange Meetings (TEMS)  and application review boards, documenting actions items/results of these events 

• Brief management, as needed, on the status of action items and/or results of activities 

• Conduct hands-on security testing, analyze test results, document risk, and recommend countermeasures  

• Assess and calculate risk based on threats, vulnerabilities, and shortfalls uncovered in testing 

• Identify mitigating countermeasures to identified threats, vulnerabilities, and shortfalls. 

• Make recommendations to the IC CISO or designee for improving TTPS for better cyber threat protection.

WHAT YOU’LL NEED TO SUCCEED:

• Education: Bachelor's Degree (Computer Engineering, Computer Science, Electrical Engineering, Information Systems, Information Technology, Cybersecurity, or a closely related discipline)

• Required Experience: 6+ yrs

• Required Technical Skills:

• Three (3) years of cybersecurity experience with at least one year of experience conducting SCAs under ICD 503/CNSSI 1253 NIST Cybersecurity Framework, Risk Management Framework (RMF), or a similar framework.

• One full year of SCA experiences within the last three calendar years.

• One full year supporting cloud environment and experience performing security assessments in a cloud environment (AWS, Google, IBM, Azure, and Oracle).

• Skill in conducting vulnerability scans and recognizing vulnerability in security systems (e.g., Cloud Environments) AWS, Google, IBM, Azure, and Oracle.

• Must meet Department of Defense (DOD) 8570.01-Manual (M) Information Assurances Workforce Improvement Program requirement for Information Assurance Manger (IAM) Level III (CISM, CISSP or Associate GSLC or CCISO).

• Knowledge of general attack strategies (e.g., MITRE ATT&CK Framework).

• Knowledge of NISPOM, ICD 503, NIST SP 800-53, ICD 705, and other ICDs as appropriate.

• Knowledge of Independent Verification & Validation (IV&V) of security controls.

• Three years of experience performing security assessments in a cloud computing environment.

• Strong writing skills.

• Knowledge of system and application security threats and vulnerabilities.

• Knowledge of network access, identity, and access management e.g. public key infrastructure (PKI)

• Knowledge of network protocols such as Transition Control Protocol/Internet Protocol (TCP/IP), Dynamic Host Configuration, Domain Name System (DNS), and directory Services.

• Ability to assess the robustness of security systems and designs.

• Knowledge of cybersecurity principles and organizational requirements (relevant to confidentiality, integrity, availability, authentication, non-repudiation).

• Write final reports and defend all findings, including risk or vulnerability, mitigation strategies, and references.

• Report vulnerabilities identified during security assessments.

• Write penetration testing Rules of Engagement (RoE), Test Plans, and Standard Operating Procedures (SOP).

• Conducted security reviews and technical research and provided reporting to increase security defense mechanisms.

• Security Clearance Level: TS/SCI with active polygraph

• Location: Bethesda, MD - On Customer Site

GDIT IS YOUR PLACE:

• 401K with company match

• Comprehensive health and wellness packages

• Internal mobility team dedicated to helping you own your career

• Professional growth opportunities including paid education and certifications

• Cutting-edge technology you can learn from

• Rest and recharge with paid vacation and holidays.

#ISP2024InnovativeTalent   

#OpportunityOwned
#GDITCareers
#WeAreGDIT
#JET