H4 Enterprises is currently seeking the following:

TITLE

Security Compliance Analyst II

LEVEL

Mid

RELATIONSHIPS

Assigned Team Leader

EDUCATION

Bachelor's degree in an Information Technology field

EXPERIENCE

10+ years of hands-on IT experience

CLEARANCE

Top Secret minimum

PLACE OF PERFORMANCE

National Capital Region

POSITION SUMMARY

The Security Compliance Analyst II will assist the assigned Government Division Chief and assigned team leader with various Information Technology (IT) security support duties that will guide the Department of State's classified systems through various computer security requirements and meet Department and Office of the Director of National Intelligence (ODNI) security mandates. This position is responsible for participating in security assessments and compliance reviews of Sensitive Compartmented Information (SCI) systems. The contractor will help improve the security posture of the organization by implementing best practices and controls to prevent or mitigate security risks and exposures.

RELATIONSHIPS

The Security Compliance Analyst II will receive direct government oversight, assignments, and directions from the assigned Government Office/ Program Director or Division Chief, through an assigned team leader.

DUTIES & RESPONSIBILITIES

Creates and develops Standard Operating Procedures, Policy, in support of the Information Assurance Branch (IAB)
Participates in all steps of the Security Authorization and Assessment process for Information Systems
Works closely with the Information Assurance Branch Chief and Chief Information Security Officer (CISO) to provide guidance and oversight for all requested initiatives

Assists with the delivery of all required system documentation using the current National Institute of Standards and Technology (NIST), Diplomatic Security (DS), & Intelligence Community (IC) approved templates, forms, regulations, policies, methods, and standards
Provides advisement to stakeholders to assign resources and establish timelines to ensure the successful security authorization of a system
Ensures software installed in the production environment is evaluated and provides guidance regarding the potential for the software to introduce risk into the environment
Continuously maintains a thorough understanding of all configurations, architecture, installed software, accounts (both Operating System and Application), data flows, ports, protocols, and other relevant data for each IT System
Coordinates with the appropriate operational group to accurately update the System Design Document for each IT system to reflect the approved state of each IT system
Analyzes Information Assurance Vulnerability Alert (IAVA) bulletins, security, and vulnerability assessment results, provides leadership with details on any required actions and related timelines, and creates mitigation plans
Analyzes system weaknesses identified during system security assessments and the related mitigation plans
Provides, tracks, and reports security requirements throughout the project life cycle of all projects that are within the accreditation boundary of assigned systems
Performs in depth reviews of logs and other artifacts for each IT system
Reviews and validates all relevant NIST 800-53 Security Controls and/or applicable departmental policies for each IT system assigned
Performs oversight of compliance with Vulnerability Alerts
Ensures that all Information Assurance Vulnerability Management (IAVM) review items are tracked and reported
Reviews and validates Plan of Actions & Milestones (POA&Ms) for each noncompliant control for each managed IT System prior to authorizing closure and ensures that proper documentation to support the POA&M lifecycle is filed and updated as required, including well documented waivers and exceptions detailing the potential risk to the Authorizing Official
Develops, documents, and executes internal audit programs, including the Federal Information Security Management Act (FISMA), to ensure that audits, inspections, and assessments appropriately address risks and management concerns
Provides oversight and guidance regarding requests to modify technical policies such as firewall rules, ports, protocols, etc. for each IT system
Coordinates with and briefs Federal staff on all activities pertaining to each IT system as requested
Leads and facilitates walkthroughs with external auditors, explaining the various processes, improvements, and responses, and provides detailed and timely responses to audits and data calls

PROFESSIONAL QUALIFICATIONS & SKILLS

Citizenship
- S. Citizenship required
Education
- Bachelor's degree in an IT field
  - Must possess the following current certifications:
    - Certified Information Systems Security Professional (CISSP)
    - Certified in Risk and Information Systems Control (CRISC)
    - Certified Information Security Manager (CISM)
    - Cybersecurity and Infrastructure Security Agency (CISA)
    - Certified Ethical Hacker (CEH)

Or

DoD 8570 Information Assurance Management (IAM) II equivalent certifications

Experience
- Over ten (10) years of hands-on IT experience
- Preferred: Department of State experience
Technical background and ability to review complex configurations for validation
Experience with the Risk Management Framework (RMF) process from both a package preparation and assessor perspective
Experience in the use of the XACTA, ACAS, and HBSS security tools
Experience with federal policies and procedures to acquire and maintain an Information System's Authority to Operate (ATO) under FISMA Act following NIST 800-53 guidelines and NIST- 800-53a security controls assessment practices
Excellent written and oral communication skills and the ability to work independently or as a member of a team
Experience with the RFM, POA&Ms, Security Authorization and Assessments
Experience conducting and documenting vulnerability assessments
Knowledge of and experience with NIST SP 800-53, 800-53A, and 800-37
Understanding of FISMA compliance
Experience with maintenance, installation, and use of WebInspect, Nessus scans, or similar tools

CLEARANCE REQUIREMENT

Position will be subject to a U.S. Government Security Investigation. Incumbent must possess or obtain/maintain minimum a TOP SECRET clearance with ability to obtain special access requirements (SCI).

PLACE OF PERFORMACE

Primarily, the work will take place at a designated Department of State Location in the National Capital Region.

This position is telework eligible and may be authorized in accordance with OPM and DS policy, only with the approval of the assigned Government Office/Program Director.

EEO Statement

H4 Enterprises, LLC does not discriminate in employment on the basis of race, color, religion, sex (including pregnancy and gender identity), national origin, political affiliation, sexual orientation, marital status, disability, genetic information, age, membership in an employee organization, retaliation, parental status, military service, or other non-merit factor.

Working at H4

Working at H4 means applying a passion for meaningful work with intellectual rigor to help solve the leading issues of our day. Smart, compassionate, innovative, committed, H4 employees tackle unprecedented challenges to benefit people, businesses, and governments around the globe. We believe in collaboration, mutual respect, open communication, and opportunity for growth. We can only solve the toughest challenges by building an inclusive workplace that allows everyone to thrive. We are an equal opportunity employer, committed to hiring regardless of any protected characteristic, such as race, ethnicity, national origin, color, sex, gender identity/expression, sexual orientation, religion, age, disability status, or military/veteran status. Together, our employees are empowered to share their expertise and collaborate with others to achieve personal and professional goals. H4 does not discriminate in employment based on race, color, religion, sex (including pregnancy and gender identity), national origin, political affiliation, sexual orientation, marital status, disability, genetic information, age, membership in an employee organization, retaliation, parental status, military service, or other non-merit factor.

COVID-19 Policy:

New or prospective U.S. employees must provide proof of complete vaccination on the date of their commencement of employment. If selected for employment, you will provide proof of your full vaccination status, defined as vaccinated two weeks after receiving the requisite number of doses of a COVID-19 vaccine approved or authorized for emergency use by the FDA. Reasonable Accommodations are available, including, but not limited to, for disabled veterans, individuals with disabilities, and individuals with sincerely held religious beliefs, in all phases of the application and employment process.