Cybersecurity Specialist/Mid-Level
** The position is hybrid-remote to DC Metro area only**
Kingfisher Systems, Inc. (Kingfisher) specializes in providing a full range of Information Technology, Cybersecurity, Intelligence, and support services to the U.S. Government. Kingfisher's core competency is technology-enabled services with a specific focus on national security. Since 2005 Kingfisher has established itself as a recognized and trusted partner whose mission is safeguarding sensitive information, operations, and programs for our Federal customers and U.S. warfighters.
Responsibilities
The Cybersecurity Specialist/Mid-Level defines, designs, and develops system requirements. Performs tradeoff analyses of performance, life-cycle cost, risk, productivity, and other system or program requirements. Assesses architecture and current hardware limitations, defines and designs system specifications, and evaluates input/output processes and working parameters for hardware/software compatibility. Coordinates design of subsystems and integration of total system. Defines system support requirements. Analyzes and resolves program support deficiencies. Conducts independent technical investigations in systems design. Evaluates vendor capabilities to provide required products or services. Government customer information systems are considered in one of three states of System Authorization: Initial Authorization, Reauthorization, or Continuous Monitoring Assessment (CMA), also known as ongoing authorization. The Cybersecurity Specialist/Mid-Level must conduct comprehensive security assessments to yield a clear understanding of security status and risk to operations and executing the mission.
- Review the customer's System Authorization process as defined in the current customer Security Authorization and Continuous Monitoring Performance Guide and associated templates and provide recommendations for updates to create a draft Assessment Package for approval.
- Review the existing information system's core documentation, including privacy requirements data to support the development of security assessment plans, to include level of rigor (depth and breadth), and schedules to support authority decision anniversary dates.
- Ensure the accuracy of the system inventory, categorization, plan of action and milestones (POA&Ms), and other technology types within the authorization boundary.
- Validate system support services (vulnerability scanning and security monitoring technology) and personnel roles, including but not limited to:
- Authorization Official and Authorization Official Designated Representative
- System Owner
- Information System Security Officer
- Privacy Officer
- Application/System Administrator
- Common Controls Provider (CCP)
- Cloud Service Provider (CSP)
- FedRAMP access to packages will be approved (as required) to ensure the accuracy of information and notification of the assessment schedule.
- Review and establish an Annual Assessment Schedule in support of deliverables and artifacts.
- Develop the required Security Assessment Plans (SAP) and Security Assessment Reports (SAR) to be compliant with the latest revisions of NIST Special Publication 800-53A Recommended Security Controls for Federal Information Systems and Organizations and NIST SP 800-37 Guide for Applying the Risk Management Framework to Federal Information Systems. The SAPs must detail the assessment scope with clarity, including specifying scope exclusions, if necessary, controls being assessed, methods of performing assessment including sampling, and determining if statements, notional schedule, assessment staff members, inventory of targeted system endpoints/components, and software, processes, status of account of system specific, and hybrid and inherited controls.
- Develop Security Assessment Motives in the customers Cybersecurity Assessment Management system (CSAM) to support controls selection commensurate to approved SAP.
- Adhere to the approved SAP while conducting authorized security assessments. Collect and catalogue evidence of security controls assessment findings (i.e., documents, screen captures, and interview session notes) to support claims of control implementation status (in-place or other).
- Develop SAR in accordance with the scope defined in the SAP. SAR must detail assessment findings of controls assessed with supporting evidence.
- Develop and update system qualitative risk assessment reports (RAR) compliant with NIST SP 800-30 Guide for Conducting Risk Assessments.
- Develop a Recommendation Report and draft a Plan of Action and Milestones in accordance with requirements in CSAM. The Recommendation Report must detail findings, applicable actions, and efforts to be considered for full weakness remediation and/or compensating measures to reduce risk (likelihood of occurrence or impact).
- Develop a Security Assessment Executive Summary including documents for a presentation, providing summary of activities completed, findings, risks, and recommendations. The Executive Summary shall include methods of data collections, reporting applications and tool suites, and processes using plain language, graphs.
- Provide an Executive Summary Briefing at customer site or hosted virtually, as determined by the COR. The briefing will include presentations, reports, evaluations, reviews, meeting minutes, and working papers in support of all tasking. Final artifacts supporting assessment activities shall be uploaded in CSAM as designated by the COR.
- Ensure all written and published media is relevant to topic and provide clear plain language without grammar or spelling errors.
Required Qualifications
- Highly skilled in cybersecurity professional with a keen understanding of technology including but not limited to application, databases, networking, and architecture to support adequate security and remediation planning activities.
- Ability to communicate complex information, concepts, or ideas in a confident and well-organized manner through verbal, written, and/or visual means.
- Experience developing and delivering System Security Plan(s) in CSAM.
- Experience in application and system continuity and risk strategies.
- Experience in network firewall, data loss prevention, network intrusion detection systems, and intrusion prevention systems.
- Experience in Operating Systems and systems services (Windows Server, Linux/Unix, and Active Directory).
- Ability to conduct dynamic web application security testing, both manual testing and utilizing application security tools to discover exploitable vulnerabilities and interpret results for remediation.
- Experience in vulnerability application and database security assessment, scanning, and results interpretation.
- Ability to format and configure large documents in Microsoft suites and Adobe PDFs.
- Ability to format and configure datasheet and workbook in Microsoft suite e.g., Excel or SharePoint List.
- Ability to function effectively in a dynamic, fast-paced environment.
Additional Requirements
- Knowledge of applicable laws, statutes, Presidential Directives, executive branch guidelines, and/or administrative/criminal legal guidelines and procedures.
- Knowledge of Federal Information Security Management Act (FISMA) of 2014.
- Knowledge of Clinger-Cohen Act of 1996 also known as the Information Technology Management Reform Act of 1996, 40 U.S.C * 1401 et seq.
- Knowledge of Privacy Act of 1974, 5 U.S.C. * 552a, as amended.
- Knowledge of Office of Management and Budget (OMB) Circular A-130, Management of Federal Information Resources, and Appendix III, Security of Federal Automated Information Systems, as amended.
- Knowledge of OMB Memorandum M-04-04, E-Authentication Guidance for Federal Agencies.
- Knowledge of National Institute of Standards and Technology (NIST) Federal Information Processing Standards (FIPS) Publication (PUB) 140, Security Requirements for Cryptographic Modules.
- Knowledge of NIST FIPS PUB 199, Standards for Security Categorization of Federal Information and Information Systems.
- Knowledge of NIST FIPS PUB 200, Minimum Security Requirements for Federal Information and Information Systems.
- Knowledge of NIST Special Publication 800-18 Rev 1, Guide for Developing Security Plans for Federal Information Systems.
- Knowledge of NIST Special Publication 800-30 Rev 1, Guide for Conducting Risk Assessments.
- Knowledge of NIST Special Publication 800-53 Rev 4 and 5 Security and Privacy Controls for Federal Information Systems and Organizations.
- Knowledge of NIST Special Publication 800-53A Rev 4, Assessing Security and Privacy Controls in Federal Information Systems and Organizations.
- Knowledge of NIST Special Publication 800-37 Rev 1, Guide for Applying the Risk Management Framework to Federal Information Systems.
- Knowledge of NIST Special Publication 800-34 Rev 1, Contingency Planning Guide for Federal Information Systems.
- Knowledge of NIST Special Publication 800-47 Rev 1, Managing the Security of Information Exchanges.
- Expert experience in Federal Information Security Modernization Act 2014 (FISMA) and federal requirement for reporting.
- Keen understanding of the National Institute of Standards and Technology (NIST) Risk Management Framework (RMF) in detail of all supporting steps and Cybersecurity Framework (CSF) and Privacy Act.
- Knowledge of Department of Homeland Security Cybersecurity & Infrastructure and Security Agency (CISA) Directives and programs e.g., Continuous Diagnostic and Mitigation (CDM).
- Understanding of information assurance, cybersecurity, and privacy policies disciplines, methodologies.
- Knowledge of current and emerging cyber technologies.
- Knowledge of Application Security Risks (e.g., Open Web Application Security Project and others).
- Knowledge of General Services Administration Federal Risk and Authorization Management Program (FedRAMP) including process for continuous monitoring.
- Understanding of Identity, Credential and Access Management (ICAM) implementation.
- Ability to work with customers to assess needs, provide assistance, resolve problems, satisfy expectations; knows products and services.
- Understanding of CSAM application and its reporting and controls management (Common, Hybrid, and System specific).
Required Certifications:
- One of the following, at a minimum:
- Certified Authorization Professional (CAP)
- Systems Security Certified Practitioner (SSCP)
- Associate Certified Information Systems Security Professional
- Certified Information System Security Professional (CISSP)
- Certified Information Systems Auditor (CISA)
Years of Experience:
- Must have a minimum of four (4) years of progressive experience supporting information technology and cybersecurity projects.
Degree Requirement:
- Bachelor's Degree or equivalent.
Minimum Clearance Requirement:
- Must be eligible for Public Trust.
U.S. Citizenship:
Location:
- The position is hybrid-remote to DC Metro area only.
Kingfisher Systems, Inc. is an Equal Opportunity Employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, gender identity, national origin, age, protected veteran status, among other things, or status as a qualified individual with a disability.
#J-18808-Ljbffr
