Information Systems Security Manager

CVP is seeking an Information System Security Manager to execute and support the implementation of a successful Assessment and Authorization (A&A) program.

Responsibilities:

• Direct the day-to-day work for a team of Information System Security Officers, referred to as Information Technology Security Advisors (ITSAs) and Security Control Assessors (SCAs)
• Provide direction, guidance, and expertise in related to:
  • Assessment and Authorization
  • Risk Management Framework
  • Continuous Monitoring
  • Change Management
  • Vulnerability Management
  • Incident Response
  • Handling of Privacy-related and sensitive data
• Integrate information security requirements into the acquisition process; using applicable baseline security controls as one of the sources for security requirements; ensuring a robust software quality control process; and establishing multiple sources (e.g., delivery routes, for critical system elements)
• Identify critical infrastructure systems with information communication technology that were designed without system security considerations.
• Advise and notify management (e.g., system owner, Chief Information Security Officer, (CISO), Chief Information Officer (CIO), and/or Authorizing Official (AO)) on:
  • Risk levels and security posture
  • Cost/benefit analysis of information security programs, policies, processes, systems, and elements
  • Changes affecting the organization's cybersecurity posture
• Support customers at the highest levels in the development and implementation of doctrine and policies, information security program management, and cybersecurity management
• Work with other stakeholders to implement information assurance and security requirements based upon the analysis of user, policy, regulatory, and resource demands within systems and the enterprise
• Experience demonstrating strong analytical, troubleshooting and problem-solving skills for security information and event management
• Continuously validate the organization against policies/guidelines/procedures/regulations/laws to ensure compliance.
• Design, develop, engineer, and implement solutions to requirements.
• Oversee and conduct complex risk analyses which also include risk assessment.
• Establish and satisfy information assurance and security requirements based upon the analysis of user, policy, regulatory, and resource demands. Assist client and team with responses to data calls and audits
• Identify measures or indicators of team performance and the actions needed to improve performance, relative to the cybersecurity goals of the organization
• Develop methods to monitor and measure risk, compliance, and assurance efforts
• Translate, track, and prioritize information needs and requirements into actionable work
• Stay abreast of new and emerging information technology (IT) and cybersecurity technologies
• Perform management and coordination tasks.
• Support enterprise security activities, including information security program management and cybersecurity management.
• Support information assurance, security assessment and authorization, and information security and privacy governance efforts, to include but not limited to:
  • Oversight of risk assessments
  • Creating and analyzing Security Plans, Operational Vulnerability Testing on systems and IT applications and services
  • Preparing Security Authorization Packages and Artifacts.

Qualifications:

• 4-year college degree in Computer Science or related field and 8 years’ experience or 12 years’ experience in lieu of a college degree.
• At least eight (8) years of cybersecurity experience, including at least two (2) years in a lead role
• CISSP, CISM, CISA, or CRISC certification required
• Experience demonstrating strong analytical, troubleshooting and problem-solving skills for cybersecurity.
• Excellent communication skills, both written and oral.
• Expert Knowledge of NIST Cybersecurity and Risk Management frameworks and associated requirements
• Knowledge of cybersecurity and privacy principles.
• Knowledge of cyber threats and vulnerabilities.
• Knowledge of cloud environments
• Knowledge of incident response and handling methodologies.
• Knowledge of new and emerging information technology (IT) and cybersecurity technologies.
• Knowledge of information security program management and project management principles and techniques.

Desired Skills

• CISSP Certification
• 5 years of federal cybersecurity support experience
• Experience with Security Assessment Tools (Tenable Nessus, DBProtect, Wireshark, WebInspect).
• Experience with ServiceNow