Responsibilities:
As the Independent Risk Assessment (SCA) Program Modernization Lead, you will play a pivotal role in modernizing and enhancing the risk assessment program for a large federal law enforcement agency, ensuring program and practices align with best practices and evolving industry standards. You will be responsible for leading the transformation of our risk assessment methodologies and strategies. As a Leader of one of our DHS support teams, you will play an important role performing a wide array of team leadership duties including:
- Oversee the identification and assessment of risks across the organization, including conducting independent risk assessments.
- Develop and execute a comprehensive strategy for modernizing the Independent Risk Assessment (SCA) program in alignment with evolving risk assessment practices and industry standards.
- Assess the organization’s existing IT security program, work products, and tools in relation to key agency mission, security goals, and objectives.
- Continuously evaluate and enhance the SCA program to adapt to emerging threats and improve risk management effectiveness.
- Integrate data analytics and modeling into risk assessments to enhance predictive capabilities and decision-making.
- Ensure the SCA program aligns with regulatory requirements and industry standards, and proactively adapt to changes in these areas.
- Develop and update policies, procedures, and guidelines related to risk assessment and management practices.
- Develop, engineer and implement sustainable security testing solutions designed to address program gaps.
- Assess and articulate risk in relation to mission/business objectives and processes.
- Document evaluation of security processes and status in support of security authorization (also referred to as C&A or A&A) activities.
Qualifications:
Required Qualifications:
- Possesses and applies expertise on multiple complex work assignments which are broad in nature, requiring originality and innovation in determining how to accomplish tasks.
- U.S Citizen
- Strong analytical and problem-solving skills, with the ability to assess complex risk issues.
- Has the ability to apply comprehensive knowledge across key tasks and high impact assignments.
- Experience planning and leading major technology projects.
- Evaluates performance results and recommends major changes affecting project growth and success.
- Functions as a technical expert across multiple project assignments.
- Must have 10 years of IT experience (inclusive of 5 year of Cybersecurity experience) if you hold a BS or Master’s Degree in an IT field. Or, 12 years of IT experience (inclusive of 7 years of Cybersecurity experience) if you hold a BS in a non-IT field. Or, 15 years of IT experience (inclusive of 9 years of Cybersecurity experience) if you do not have a degree. ** Must have an active CAP or CISA certification.
Preferred Qualifications:
- In-depth knowledge of risk assessment methodologies, frameworks, and regulatory requirements.
- Familiarity with one or more of DHS Directive 4300A, FIPS Pubs 199 & 200, and NIST Special Pubs 800-30, 800-37, 800-39, 800-53, 800-60
- Extensive experience as an Information System Security Officer (ISSO) or Information Security Engineer
- Extensive experience in independent risk assessment program management, including modernization initiatives and compliance with risk management standards.
- Experience with Vulnerability, Configuration, and Asset Management tools in support of Continuous Monitoring
- Experience in developing and implementing risk management policies and practices.
- Experience with POA&M management
- Experience performing Security Authorization
- Experience performing Risk Analysis and Assessment
- Experience with XACTA or similar tool
- CAP or Security + certification
- Should be able to support a minimum of four of the areas listed:
- Security Control Assessment
- Security Code Analysis
- Product Evaluation
- Document Review and Security Technical Writing
- Risk Assessment and Risk Management
- Policy and Audit Services
- 5 or more years directly supporting security of IT systems
Demonstrated capabilities performing the following:
- Ensuring the automated monitoring of information system assets through Continuous Diagnostics and Mitigation (CDM) tools and sensors;
- Evaluating asset inventory of hardware and software within the program/development offices or field site facility;
- Ensuring that security requirements for the assigned major application or general support system are being or shall be met;
- Ensuring that requests for Security Authorization (SA, also commonly referred to as Assessment & Authorization or Certification and Accreditation) of assigned major application or general support systems are completed in accordance with the published procedures;
- Coordinating the development of a Contingency Plan and ensuring that the plan is tested and maintained;
- Ensuring risk analyses are completed to determine cost-effective and essential safeguards in alignment with government and industry best practice (e.g. NIST 800-30, 37, 39);
- Ensuring preparation of security plans for sensitive systems and networks;
- Reporting IT security incidents (including computer viruses) in accordance with established procedures;
- Reporting security incidents not involving IT resources to the appropriate security office; and representing the security team as part of change management for assigned information systems.