Job description
cFocus Software seeks a Geospatial ISSO to join our program supporting the Department of Homeland Security (DHS). This position is remote. This position requires a Public Trust Clearance.
Qualifications:
Bachelor’s or master’s degree in IT, Computer Science, Geography or a related field.
6+ years of cybersecurity or information-assurance experience, including at least five years performing ISSO, system-security, RMF, authorization, compliance, or continuous-monitoring responsibilities for federal information systems.
Demonstrated experience implementing and assessing NIST SP 800-53 security controls and maintaining SSPs, authorization artifacts, POA&Ms, control evidence, and continuous-monitoring records.
Experience supporting FISMA authorization and ongoing authorization, ATO/ATC activities, vulnerability and patch management, security assessments, audit/data-call responses, and change-control security reviews.
Knowledge of DHS MD 4300A or comparable federal sensitive-system policy, NIST Risk Management Framework, NIST SP 800-37, NIST SP 800-53, NIST SP 800-137, FISMA, OMB A-130, and federal privacy/security requirements.
Experience analyzing authenticated scan results, adjudicating findings, coordinating remediation, validating evidence, and reporting security posture and risk to Government stakeholders.
Ability to advise a Government System Owner and collaborate effectively with engineers, developers, administrators, architects, cloud teams, privacy personnel, assessors, and program leadership.
Strong technical writing, analysis, organization, communication, and documentation-quality skills.
Ability to satisfy DHS suitability, background-investigation, Entry on Duty, security, and system-access requirements for the assigned position.
Active CISSP, CISM, GSLC, CAP/CGRC, CASP+, or another advanced information-security or risk-management certification.
Experience serving as an ISSO for DHS, another federal civilian agency, or a mission-critical FISMA Moderate/High system.
Working knowledge of ESRI Portal/ArcGIS Enterprise, ArcGIS Online, geospatial web services, enterprise geodatabases, custom GIS applications, or location-intelligence environments.
Experience securing AWS or other enterprise cloud environments, identity and access integrations, APIs, web applications, data pipelines, and hybrid infrastructures.
Experience with DHS ISVM processes and Swimlane or comparable vulnerability/compliance workflow platforms.
Experience with privacy compliance, interconnection agreements, contingency planning and exercises, Section 508, IPv6, DevSecOps, or system-security engineering
Duties:
Serve as the principal advisor to the GII System Owner on cybersecurity requirements, risk, compliance, authorization posture, control effectiveness, and security impacts across geospatial capabilities.
Interpret and apply DHS MD 4300A Sensitive Systems Policy, DHS security authorization guidance, FISMA, OMB and NIST requirements, DHS privacy rules, and other applicable directives throughout the Systems Engineering Life Cycle.
Coordinate with GMO leadership, developers, system administrators, architects, cloud providers, data managers, technical support, privacy personnel, DHS security organizations, and other enterprise stakeholders.
Assess emerging technical, operational, and geospatial requirements for security implications and provide timely, risk-informed recommendations to the System Owner and program leadership.
Maintain clear separation of authority: provide guidance and recommendations while preserving final Government decisions, approvals, risk acceptance, and signatures
Ensure implementation, maintenance, and evidence of management, operational, and technical security controls required by the GII System Security Plan (SSP) and DHS policy.
Maintain the SSP and supporting authorization documentation so that system boundaries, components, data flows, interfaces, control implementation statements, responsibilities, and evidence reflect the current operating environment.
Coordinate control implementation and evidence collection for ESRI Portal, ArcGIS Online, AWS-hosted applications and infrastructure, identity and access services, geospatial data services, custom applications, networks, and enterprise integrations.
Identify control gaps, weaknesses, dependencies, and inherited-control issues; assign or coordinate remediation ownership and track corrective actions through approved processes.
Support annual SSP updates and other security-documentation refreshes required by the DHS authorization and compliance lifecycle.
Execute the GII Information Security Continuous Monitoring (ISCM) program and provide current visibility into system assets, vulnerabilities, configuration, control effectiveness, and changes in security posture.
Coordinate and review credentialed/authenticated scans and other automated security-management outputs in accordance with the current ISCM strategy.
Review, validate, and adjudicate findings from continuous monitoring, vulnerability diagnosis, patching, configuration assessment, and mitigation activities.
Perform and document monthly ISCM review and adjudication activities, maintain traceable evidence, identify trends and recurring weaknesses, and escalate material risks.
Coordinate with operations and engineering teams on monthly patching, emergency fixes, vulnerability remediation, and follow-up validation while minimizing mission disruption.
Maintain dashboards, metrics, findings status, and decision-support reporting needed to demonstrate confidentiality, integrity, availability, and continued authorization
Prepare, maintain, validate, and organize artifacts supporting assessment, authorization, certification/accreditation, Authority to Operate (ATO), and Authority to Connect (ATC) activities.
Coordinate evidence requests, control assessments, security testing, authorization reviews, and remediation activities with assessors, technical teams, program personnel, and DHS stakeholders.
Maintain an authorization-ready posture by ensuring artifacts are accurate, current, internally consistent, traceable, and aligned with the operational environment.
Respond to DHS cybersecurity investigations, data calls, and requests for information concerning the GII security posture.
Support compliance reporting and corrective actions arising from security assessments, audits, vulnerability reviews, and Government direction.
Originally posted on Himalayas
Who can apply
Eligible countries: United States. Accepted UTC offsets: UTC-10, UTC-9, UTC-8, UTC-7, UTC-6, UTC-5, UTC+14. Review the full description for employer-specific work authorization, residency and schedule requirements.