It's fun to work in a company where people truly BELIEVE in what they're doing!
We're committed to bringing passion and customer focus to the business.
SUMMARY
The CyberSecurity Assessment and Authorization Analyst provides support to the Department of Health and Human Services, Indian Health Service (IHS). This position is responsible for executing and assisting in the completion of security certifications and for providing support in the development and implementation of a program to manage all aspects of compliance with government regulations
ESSENTIAL DUTIES AND RESPONSIBILITIES
Essential duties and responsibilities include the following. Other duties may be assigned.
Conducts annual security controls effectiveness testing. Documents findings and advises and monitors remediation efforts on all systems in accordance with established policy and procedures.
Conducts significant research, evaluation, recommendation, and documentation development such as security assessment reports, methodologies, briefings, and presentations.
Conducts information security audits/risk assessments on customer systems and network and documents in accordance with NIST, Risk Management Guide for Information Technology Systems.
Annually reviews and updates the security and contingency plan for each system in conjunction with security audits and makes recommendations to address deficiencies.
Assists system owners in developing security authorization packages that are fully compliant with National Institute of Standards and Technology (NIST) guidelines and organizational defined standards.
Evaluates the implementation of security controls as required by NIST. Prepares security authorization packages using approved customer templates.
Assists in meeting mandates, directives, reporting, and other security-related processes with respect to Federal regulations such as FISMA; Health Insurance Portability and Accountability Act (HIPAA); Office of Management and Budget (OMB) mandates; Homeland Security Presidential Directives (HSPD); Federal Information Processing Standards (FIPS) and NIST guidance implementation, oversight, and compliance.
Reviews and updates risk assessments when significant changes occur to systems/network.
Ensures customer information and information systems are adequately protected from unauthorized access, use, disclosure, disruption, modification, or destruction. Briefs and provides documented results to staff. Briefs include, at a minimum, areas of conformance to directives, corrective recommendations for deficiencies, and POA&M explanations to correct deficiencies.
Analyzes major IT systems, from a security perspective, during the initial phases of system development and throughout the systems development lifecycle.
Reviews standard security configurations to assure compliance with federal directives and industry best practices.
Responsible for aiding in own self-development by being available and receptive to all training made available by the company.
Plans daily activities within the guidelines of company policy, job description and supervisor’s instruction in such a way as to maximize personal output.
Responsible for keeping own immediate work area in a neat and orderly condition to ensure safety of self and co-workers. Will report any unsafe conditions and/or practices to the appropriate supervisor and human resources. Will immediately correct any unsafe conditions to the best of own ability.
CNI CORE COMPETENCIES
Responsible for the integration of CNI Core Competencies into daily functions, including: commitment to integrity, knowledge / quality of work, supporting financial goals of the company, initiative / motivation, cooperation / relationships, problem analysis / discretion, accomplishing goals through organization, positive oral / written communication skills, leadership abilities, commitment to Affirmative Action, reliability / dependability, flexibility and ownership / accountability of actions taken.
COMPLIANCE
Promotes and encourages a culture of compliance with all applicable rules (federal, state, local, Federal Acquisition Regulations, Code of Federal Regulations, Prime Contract requirements, etc.) for themselves and the company as a whole. Fosters an environment in which they will report any violations or reasonably suspected violation of CNI policy, FAR, and/or CFR and are comfortable discussing the myriad compliance, conflict, FAR, CFR, etc. issues that arise during the performance of a government contract.
EDUCATION/EXPERIENCE
Bachelor's degree in Computer Science or a related field of study and a minimum of eight (8) years’ relevant experience, or equivalent combination of education / experience.
Must have at least eight years (8) of information security experience and with at least four (4) years of certification and accreditation (C&A) compliance / Security Assurance (SA) experience (NIST based).
CERTIFICATES, LICENSES, REGISTRATION
CAP, CISSP, CISM, CISA, SANS GIAC, Security+, Network+, Linux+, MCSE, CCNA or SSCP certifications preferred.
JOB SPECIFIC KNOWLEDGE / SKILLS / ABILITIES
In depth knowledge of NIST SP 800 series and FedRAMP guidance and standards.
Highly organized with ability to effectively manage multiple projects and priorities.
Ability to work in a fast-paced environment and to learn and apply new knowledge and techniques related to incident response and continuous monitoring capabilities.
Ability to effectively work both independently and in a team environment for the successful achievement of goals.
Excellent verbal and written communications skills with ability to prepare quality reports and effectively communicate / interact with a wide variety of technical and non-technical audiences (i.e., customers, team members, management, and federal staff).
Excellent critical thinking skills with ability to identify, analyze and resolve problems / complex issues.
Working knowledge and understanding of OMB, FISMA, FIPS, HIPPA and other federal regulations and requirements associated with Information Security.
Knowledgeable of security-related processes with respect to Federal risk and compliance regulations best practices.
Ability to read, analyze, and interpret common information systems security documents.
Expert computer skills with advanced proficiency in a Windows and Linux based computer environment.
LANGUAGE SKILLS
Ability to read, analyze and interpret common scientific and technical journals, financial reports, and legal documents. Ability to respond to common inquiries or complaints from customers, regulatory agencies, or members of the business community. Ability to write speeches and articles for publication that conform to prescribed style and format. Ability to effectively present information to top management, public groups, and/or boards of directors.
MATHEMATICAL SKILLS
Ability to calculate figures and amounts such as discounts, interest, commissions, proportions, percentages, area, circumference, and volume. Ability to apply concepts of basic algebra and geometry.
REASONING ABILITY
Ability to define problems, collect data, establish facts, and draw valid conclusions. Ability to interpret an extensive variety of technical instructions in mathematical or diagram form and deal with several abstract and concrete variables.
PHYSICAL DEMANDS
The physical demands described here are representative of those that must be met by an employee to perform successfully the essential functions of this job. Reasonable accommodations may be made to enable individuals with disabilities to perform the essential functions of this job. Work is primarily performed in an office environment. Regularly required to sit. Regularly required use hands to finger, handle, or feel, reach with hands and arms to handle objects and operate tools, computer, and/or controls. Required to speak and hear. Occasionally required to stand, walk and stoop, kneel, crouch, or crawl. Must frequently lift and/or move up to 10 pounds and occasionally lift and/or move up to 25 pounds. Specific vision abilities required by this job include close vision, distance vision, depth perception, and ability to adjust focus. Exposed to general office noise with computers printers and light traffic.
CNI offers a comprehensive benefits package that includes:
- Medical
- Dental
- Vision
- 401(k)
- STD/LTD/AD&D
- Employee Assistance Program (EAP)
- Paid Time Off (PTO)
- Training and Development Opportunities
EQUAL EMPLOYMENT OPPORTUNITY STATEMENT
All qualified applicants will receive consideration for employment without regard to race, color, sex, sexual orientation, gender identity, religion, national origin, disability, veteran status, age, marital status, pregnancy, genetic information, or other legally protected status.
#INDCNI
If you like wild growth and working with happy, enthusiastic over-achievers, you'll enjoy your career with us!
