Duties/Tasks and Responsibilities

As an Information Systems Security Engineer (ISSE), a candidate will be expected to perform a multitude of activities; including security engineering, vulnerability testing, support continuous monitoring operations, assessing and managing risk, responding to threats, and assist in the development of policies and procedures critical to fulfilling the Agency’s IA mission.

The ISSE will also:

• Support the design, development, implementation, and/or integration of IA architectures, systems, or system components.
• Ensure that the architecture and design of information systems are functional and secure, including program of record systems, and special purpose environments with platform IT inter-connectivity
• Conduct system or network designs that encompass multiple enclaves, to include those with differing data protection/classification requirements  
• Apply IA policy, procedures, and workforce structure to design, develop, and implement secure networking, computing, and enclave environments

Qualifications: 

• 12 years of IA System Architect and Engineer (IASAE) experience, to include, recent experience within the last 5 years, with Defense-in-Depth principles and technology, including access/control, authorization, identification and authentication, PKI, network and enterprise security architecture
• 2 years of experience applying security risks assessment methodology to system development, including threat model development, vulnerability assessments, and resulting security risk analysis
• A Bachelor’s Degree in Computer Science or IT Engineering is desired and may be substituted for 4 years of experience
• Knowledge of Federal, NSA, IC, and DoD Information Security regulations, publications, and policy 
• DoD 8570 compliance with IASAE Level 2 requirements

Desired Requirements:

• BS degree in a computer or system science discipline from an accredited college or university and 10+ years of progressive, relevant experience, or an MS degree in a computer or system science discipline and 8+ years of progressive experience, or a Ph.D. degree in a computer or system science discipline and 4+ years of progressive experience.

Duties & Responsibilities:

 The Senior Information Systems Security Engineer will perform, or review, technical security assessments of computing environments to identify points of vulnerability, non-compliance with established Information Assurance (IA) standards and regulations and recommend mitigation strategies. 

• Validates and verifies system security requirements definitions and analysis and establishes system security designs. 
• Designs, develops, implements and/or integrates IA and security systems and system components including those for networking, computing, and enclave environments to include those with multiple enclaves and with differing data protection/classification requirements. 
• Builds IA into systems deployed to operational environments. 
• Assists architects and systems developers in the identification and implementation of appropriate information security functionality to ensure uniform application of Agency security policy and enterprise solutions. 
• Supports the building of security architectures. 
• Enforce the design and implementation of trusted relations among external systems and architectures. 
• Assesses and mitigates system security threats/risks throughout the program life cycle. 
• Contributes to the security planning, assessment, risk analysis, risk management, certification and awareness activities for system and networking operations. 
• Reviews certification and accreditation (C&A) documentation, providing feedback on completeness and compliance of its content

Qualifications: 

• 14 years of IA System Architect and Engineer (IASAE) experience, to include recent experience within the last 5 years, with Defense-in-Depth principles and technology, including access/control, authorization, identification and authentication, Public Key Infrastructure (PKI), network and enterprise security architecture
• 2 years of experience applying security risks assessment methodology to system development, including threat model development, vulnerability assessments, and resulting security risk analysis
• Knowledge of Federal, NSA, IC, and DoD Information Security regulations, publications, and policy
• CISSP-ISSAP or CISSP-ISSEP Certification
• Active TS/SCI w/Poly clearance

Duties & Responsibilities:

The Senior Security Controls Assessor is responsible for:

• Conducting a comprehensive assessment of the management, operational, and technical security controls employed within or inherited by an IS to determine the overall effectiveness of the controls (i.e., the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting the security requirements for the system). 
• Providing an assessment of the severity of weaknesses or deficiencies discovered in the IS and its environment of operation and recommend corrective actions to address identified vulnerabilities.

Qualifications: 

• Active TS/SCI with current polygraph
• 12 years of related work experience. A Bachelor’s Degree in Computer Science or IT Engineering may be substituted for 4 years of experience
• DoD 8570-1M Change 2 IAT Level III or IAM Level III requirements (CASP CE, CCNP Security, CISA, CISSP (or Associate), GCED, GCIH, CISM OR GSLC 

Desired Skills

• Strong presentation, report writing and customer interface skills
• Familiarity with various operations systems such as Microsoft Windows, various versions of UNIX (AIX, Solaris, HPUX, etc), and Linux
• Detailed knowledge of TCP/IP and other major protocols (i.e. NetBEUI, NETBIOS, IPX/SPX) and the inherent weaknesses of the protocols
• Understanding of ‘hacking’ methodology concerning performing a vulnerability assessment
• Ability to describe a system’s avenues of compromise in a network environment and differentiate between various types of network attacks
• An understanding of a typical secure topology and architecture for a site connected to the Internet (i.e. routers, firewalls, web servers)
• Understanding of how to read and interpret a network diagram and identify possible security related concerns
• The ability to keep a robust security skill set current and to work on multiple projects concurrently 

Job Description:

• Provides experienced project and/or task related document preparation, editing, and quality assurance
• Performing technical editing of Technical Reports (SAR) and tool related User Guides; and developing Standard Operating Procedures (SOP)
• Consolidates technical inputs and analyses, and produces a logical, understandable IA related document
• Consolidates technical inputs and analyses, and produces a logical, understandable IA related document. Ability to interpret engineering and maintenance drawings, operational procedures, and absorb and synthesize large quantities of computer-related information are important characteristics of the successful candidate within this labor category

 Qualifications:

• TS/SCI w/Poly Required
• 8 years of Technical Writing experience.
• Minimum 2 years of experience in the past 5 years with desktop publishing, automated work processing, and other digital information technology applications, including World Wide Web publishing
• Ability to interpret engineering and maintenance drawings, operational procedures, and absorb and synthesize large quantities of computer-related information are important characteristics of the successful candidate within this labor category
• Excellent oral and written communication skills in a team environment