Cybersecurity Analyst / Information Systems Security Officer (ISSO)

Overview

KBR is seeking a Cybersecurity Analyst / Information Systems Security Officer (ISSO) to join the team at Peterson SFB in Colorado Springs, Colorado. An active TS/SCI clearance is required. In this role, you will coordinate closely with team members to ensure systems are operated, maintained, and disposed of in alignment with applicable security policies and procedures.

Key Responsibilities

• Convert accreditation packages from DoDRMF Rev. 4 to Rev. 5
• Compile and track vulnerabilities and mitigation results to quantify program effectiveness
• Create and maintain vulnerability management policies, procedures, and training
• Apply security policies to meet system security objectives
• Apply updates, patches, and security technical implementation while maintaining control system performance and availability requirements
• Establish and maintain security configuration baselines for control systems, including IT components, interconnections, and interfaces
• Implement Risk Management Framework (RMF) assessment requirements for control systems and document and maintain records
• Maintain knowledge of control system security and the IT technologies they interface with
• Perform asset management and maintain an inventory of control system devices and components through physical inspection or logical scans
• Support risk assessments by reviewing and documenting the implementation status of security requirements
• Mitigate or correct security deficiencies identified during security and certification testing, or recommend risk acceptance to the appropriate senior leader or authorized representative
• Provide input to RMF process activities and related documentation, including system life-cycle support plans, concept of operations, operational procedures, and maintenance training materials
• Review and define requirements for information security solutions, controls compliance, and policy development
• Organize network-based scans to identify possible network security attacks and host-based scans to identify vulnerabilities in workstations, servers, and other network hosts
• Determine critical security flaws and identify how to address them
• Conduct audits and assessments to uncover vulnerabilities in networks using scanning tools
• Assist in improving and automating the vulnerability management lifecycle, including data ingestion and normalization, compliance metrics, and detections on assets
• Partner with tools and technology teams to troubleshoot, develop, select, implement, and automate security solutions to protect system data from internal and external threats
• Support scanning and vulnerability remediation reporting issue resolution
• Communicate the risks of identified vulnerabilities and recommend cost-effective security controls to mitigate risks
• Stay current with vulnerability information across all products in the AVAC environment
• Develop and maintain RMF body of evidence documentation using Enterprise Mission Assurance Support Service (eMASS), XACTA, or equivalent products
• Maintain repositories of body of evidence documentation for systems under your purview
• Develop and execute security control assessment procedures to verify conformance with control requirements as part of ongoing continuous monitoring and authorization assessment activities
• Ensure security-related vulnerabilities and deficiencies are documented in the Plan of Action and Milestones (POA&M) for each system
• Ensure configuration management policies and procedures for authorizing use of hardware and software are followed, and coordinate system baseline changes with appropriate stakeholders before changes
• Create and maintain RMF package documentation for multiple networks
• Advise ISSM of compliance issues, findings, and status related to the system packages

Required Qualifications

• Active TS/SCI clearance required
• DoD Directive (DoDD) 8140.01 certification and Security+
• 2+ years of related experience
• Working knowledge of DoDRMF Rev. 4 and/or 5, cyber technologies, NIST standards, and DISA STIG governance
• Experience with the Agile Lifecycle, including requirements, design, development, implementation, deployment, and remediation
• Excellent technical document preparation and verbal communication skills
• Strong working knowledge of CIA concepts, including patch management, multi-factor authentication, host-based security, intrusion detection, security event management, and defense-in-depth
• Strong analytical skills for known vulnerabilities and system compliance
• Effective interpersonal skills with demonstrated ability to support complex organizational relationships

Desired Qualifications

• Bachelor’s Degree (IT or Cybersecurity related) or equivalent related experience
• GSEC, SCNP, SSCP, CISSP or higher
• Experience with RMF controls, eMASS or XACTA, risk assessment, Plan of Actions and Milestones (POAMs), policy and plans documentation
• Experience with Information Assurance Vulnerability Management (IAVM) and vulnerability assessment for mission systems

Work Environment

• Location: Onsite
• Work Hours: Standard

Compensation

For Colorado only, the salary range for this position is approximately $90,000 - $105,000. The offered rate will be based on the selected candidate’s knowledge, skills, abilities, and/or experience, and in consideration of internal parity.

KBR may offer bonuses, commissions, or other forms of compensation to certain job titles or levels, per internal policy or contractual designation. Additional compensation may include sign-on bonus, relocation benefits, short-term incentives, long-term incentives, or discretionary payments for exceptional performance.

Benefits

KBR offers a selection of competitive lifestyle benefits which could include a 401K plan with company match, medical, dental, vision, life insurance, AD&D, flexible spending account, disability, paid time off, or a flexible work schedule. KBR supports career advancement through professional training and development.