ISSOControl Evaluator – Low

Koniag Data Solutions LLC a Koniag Government Services company is seeking an ISSO/Control Evaluator Low to support KDS and our government customer in Washington DC. This position requires the candidate to be able to obtain a Public offer competitive compensation and an extraordinary benefits package including health dental and vision insurance 401K with company matching flexible spending accounts paid holidays three weeks paid time off and Data Solutions a Koniag Government Services company is seeking a motivated and detail-oriented Junior Information Systems Security Officer (ISSO) / Control Evaluator to support the U.S. Small Business Administration (SBA). The ideal candidate is an early-career information security professional with a foundational understanding of federal information security requirements security control frameworks and the NIST Risk Management Framework (RMF). This individual will work under the guidance of senior ISSO and security authorization staff to support the security authorization and continuous monitoring of SBAs information systems gaining hands-on experience in federal cybersecurity compliance and security control assessment activities. The Junior ISSO/Control Evaluator will support the security authorization and continuous monitoring of SBAs information systems under the direction of mid-level and senior ISSO staff assisting with security control assessments security documentation development and maintenance and day-to-day information security support activities. Principal responsibilities will include but are not limited to:Support senior ISSO staff in fulfilling Information Systems Security Officer responsibilities for assigned SBA information systems providing day-to-day information security assistance and administrative support to system owners program teams and IT in supporting the NIST Risk Management Framework (RMF) lifecycle for assigned systems including security categorization security control selection and tailoring reviews security control implementation documentation security control assessment support and continuous monitoring activities under the direction of senior security in the development maintenance and updating of security authorization documentation for assigned systems including System Security Plans (SSPs) Security Assessment Reports (SARs) Plans of Action and Milestones (POA&Ms) Risk Assessment Reports (RARs) and other ATO package artifacts in accordance with NIST SP 800-53 and SBA security documentation the conduct of security control assessments for assigned systems assisting senior assessors in applying NIST SP 800-53A assessment procedures to evaluate the design implementation and operational effectiveness of security controls and contributing to the documentation of assessment findings in Security Assessment Reports (SARs).Assist in the development and maintenance of POA&M items for assigned systems supporting the tracking of identified security weaknesses and compliance deficiencies coordinating with system owners and IT teams on remediation activities and maintaining accurate and current POA&M continuous monitoring activities for assigned systems assisting in the collection review and analysis of security control assessment results vulnerability scan findings configuration compliance data and other security-relevant information to support the assessment of ongoing system security in the review and analysis of vulnerability scan results for assigned systems supporting senior ISSO staff in assessing the severity of identified vulnerabilities tracking remediation activities and maintaining accurate vulnerability management the preparation of security authorization packages for assigned systems assisting in the compilation and quality review of ATO documentation to ensure completeness accuracy and alignment with SBA and federal documentation system owners developers and IT operations teams in understanding and implementing security requirements for assigned systems providing basic technical guidance and information on NIST SP 800-53 security controls under the supervision of senior ISSO the review and documentation of proposed system changes and configuration changes for assigned systems assisting in the assessment of potential security impacts under the guidance of senior security in incident response coordination activities for assigned systems supporting the collection and documentation of security incident information and facilitating communication between system owners and the SOC and incident response the development and maintenance of system-level security documentation for assigned systems including configuration management plans incident response plans contingency plans and other system security documentation ensuring records remain current and in preparing for and supporting third-party security assessments OIG audits and other external evaluations supporting the collection organization and quality review of required evidence and supporting in security training professional development activities and knowledge-sharing sessions to build foundational expertise in federal information security RMF processes and ISSO to the continuous improvement of SBAs security authorization and continuous monitoring program by identifying documentation inconsistencies process inefficiencies and areas for quality improvement and communicating observations to senior and Experience:Required:Bachelors degree in Cybersecurity Information Technology Computer Science Information Assurance or a related field from an accredited college or university.1-3 years of experience in information security IT or a related field with demonstrated exposure to federal information security concepts NIST frameworks or security authorization familiarity with the NIST Risk Management Framework (RMF) process and federal information security documentation or more of the following certifications:CompTIA SecurityCompTIA CySAGIAC Security Essentials (GSEC)Systems Security Certified Practitioner (SSCP)CompTIA A or Network (with demonstrated interest and coursework in cybersecurity)Desired:2 years of experience in an information security IT or cybersecurity-related role with hands-on exposure to federal security authorization RMF documentation or security control assessment internship academic project or work experience supporting federal government information security or cybersecurity compliance Authorization Professional (CAP) / ISC2 Certified in Governance Risk and Compliance (CGRC) certification or active pursuit of Skills and Competencies:Strong communication skills in English both written and oral with the ability to clearly communicate information security concepts documentation status and findings to peers senior staff and non-technical stakeholders under the guidance of senior ISSO understanding of the NIST Risk Management Framework (RMF) process including the purpose and activities associated with each step of the RMF lifecycle (Prepare Categorize Select Implement Assess Authorize Monitor).Basic working knowledge of NIST SP 800-53 security and privacy controls including the ability to read and interpret control requirements and assist in the documentation of control implementation descriptions within SSPs and related authorization with federal security authorization documentation types and their purpose including SSPs SARs POA&Ms RARs and other ATO package understanding of federal cybersecurity compliance requirements including FISMA OMB Circular A-130 FIPS 199 FIPS 200 and the role of these requirements in shaping ISSO responsibilities and security authorization knowledge of vulnerability management concepts including an understanding of common vulnerability scoring systems (CVSS) and the ability to assist in the review and interpretation of vulnerability scan results under senior staff familiarity with continuous monitoring concepts and the role of ongoing security assessments vulnerability scanning and configuration compliance monitoring in maintaining the security posture of federal information attention to detail and organizational skills with the ability to assist in managing multiple documentation and administrative tasks across assigned systems accurately and efficientlyDemonstrated ability and willingness to work collaboratively under the direction of senior staff in a team-oriented environment actively seeking guidance and applying feedback to improve work quality and professional familiarity with common IT concepts including networking fundamentals operating systems and application security as they relate to the implementation and assessment of security controlsStrong work ethic intellectual curiosity and commitment to continuous learning and professional development in the field of federal information security and cybersecurity to obtain and maintain a Public Trust Skills and Competencies:Prior experience or academic coursework related to federal information security NIST RMF security control frameworks or cybersecurity compliance demonstrating a foundational understanding of federal security authorization concepts and with cloud computing concepts and basic cloud security principles including an awareness of the security implications of cloud service adoption and FedRAMP authorization requirements within federal familiarity with GRC platforms and tools used for managing RMF documentation and POA&M tracking within federal environments such as CSAM Archer or ServiceNow of privacy control requirements and their relationship to ISSO responsibilities including a basic understanding of NIST SP 800-53 privacy controls and federal privacy laws and with the CDM (Continuous Diagnostics and Mitigation) program and its role in supporting continuous monitoring and cybersecurity compliance activities within federal civilian scripting or automation skills such as familiarity with Python or PowerShell with an interest in applying automation to improve the efficiency of security documentation and assessment support with Agile and DevSecOps methodologies and an awareness of their implications for security authorization and ISSO responsibilities within iterative software development interest in pursuing advanced cybersecurity certifications such as the Certified Authorization Professional (CAP)/CGRC CISSP or CISM as part of a long-term professional development planExperience using Microsoft Office Suite tools including Word Excel and PowerPoint to develop maintain and present security documentation and program reports effectivelyParticipation in cybersecurity competitions academic research professional associations or other extracurricular activities demonstrating a genuine passion for information security and a commitment to professional growth in the Equal Employment Opportunity PolicyThe company is an equal opportunity employer. The company shall not discriminate against any employee or applicant because of race color religion creed ethnicity sex sexual orientation gender or gender identity (except where gender is a bona fide occupational qualification) national origin or ancestry age disability citizenship military/veteran status marital status genetic information or any other characteristic protected by applicable federal state or local law. We are committed to equal employment opportunity in all decisions related to employment promotion wages benefits and all other privileges terms and conditions of company is dedicated to seeking all qualified applicants. If you require an accommodation to navigate or apply for a position on our website please get in touch with Heaven Wood via e-mail by calling to request Government Services (KGS) is an Alaska Native Owned corporation supporting the values and traditions of our native communities through an agile employee and corporate culture that delivers Enterprise Solutions Professional Services and Operational Management to Federal Government Agencies. As a wholly owned subsidiary of Koniag we apply our proven commercial solutions to a deep knowledge of Defense and Civilian missions to provide forward leaning technical professional and operational solutions. KGS enables successful mission outcomes for our customers through solution-oriented business partnerships and a commitment to exceptional service delivery. We ensure long-term success with a continuous improvement approach while balancing the collective interests of our customers employees and native communities. For more information please Opportunity Employer/Veterans/ Preference in accordance with Public Law 88-352