Tharros supports the Department of Homeland Security (DHS) with cybersecurity services across its Intelligence Enterprise. In support of this mission, we have an immediate opportunity for a Junior Information Systems Security Officer, National Vetting Center.
In this role you will work with the senior NVC ISSO to maintain authorization artifacts, track POA&Ms, review audit logs, and support assessment and cloud security engineering activities for NVC systems. This position is on-site in a Government SCIF in Washington, DC.
- Maintain security artifacts (SSP, POA&Ms, risk exceptions, contingency plans, PTAs) for NVC systems in the GRC tool.
- Track POA&Ms on 30/60/90/120/180-day review intervals and provide weekly or bi-weekly activity reports.
- Perform audit log reviews at least weekly and respond to NOSC alerts.
- Ensure periodic vulnerability scans are performed and review scan results.
- Support security control assessments and cloud security engineering for NVC systems.
- Submit IATT requests and notify the ISSM, SCA, and AO of changes affecting authorization.
- Serve as SCIF Information Security Compliance Representative for assigned spaces.
Requirements:
- BS degree in Information Technology, Cybersecurity, Information Systems, or Computer Science OR minimum of 4 years' experience in IT or cybersecurity.
- Minimum of 1 year of experience in ISSO, RMF, or security compliance support.
- Active Top Secret clearance with contingency on DOD CAS granting SCI eligibility.
- Knowledge of the Risk Management Framework (RMF), NIST SP 800-37, and NIST SP 800-53.
- Knowledge of hybrid classified/unclassified, on-premise and cloud environments.
- Knowledge of DevSecOps and agile methodologies.
- Skill in securing Linux and Windows operating systems.
- Skill in POA&M tracking and audit log review.
- Ability to maintain accurate documentation across multiple systems.
- Proficient in Microsoft Office Suite to include Teams or similar workplace chat and videoconferencing tools.
- Excellent written and oral communications skills.
Desired
- CompTIA Security+ or CySA+ certification.
- Experience with RSA Archer, eMASS, or a similar GRC tool.
- Cloud security experience (AWS or Azure).