Information Systems Security Officer (ISSO) at NTT DATA

Merrifield, Virginia, United States -

Full Time

Start Date

Immediate

Expiry Date

21 Jan, 26

Salary

0.0

Posted On

23 Oct, 25

Experience

10 year(s) or above

Remote Job

Yes

Telecommute

Yes

Sponsor Visa

Skills

Cybersecurity, Risk Assessment, System Security Plans, Incident Response, Documentation Management, Compliance Monitoring, Stakeholder Communication, Policy Development, Security Controls, System Development Lifecycle, Configuration Management, Vulnerability Management, Training and Awareness, Supply Chain Risk Management, Assessment and Authorization, Continuous Monitoring

Industry

IT Services and IT Consulting

Description

1. The ISSO ensures compliance with cybersecurity standards and manages system risk. a. Ensure assigned systems comply with NIST, FISMA, FedRAMP, and agency frameworks, regulations, and guidance. b. Conduct risk assessments and support the development of mitigation plans. c. Assist in creation of and validation of System Security and Privacy Plans (SSPPs). d. Validate security controls implementation in accordance with RMF requirements. e. Support the Assessment and Authorization (A&A) process. 2. The ISSO supports developing, maintaining, managing security documentation and reporting. a. Prepare and maintain SSPs, SARs, POA&Ms, ISCPs, IRPs, CMPs, and related artifacts. b. Track and manage POA&Ms to address vulnerabilities and deficiencies. c. Generate system security status reports and metrics for leadership and auditors. d. Ensure documentation is accurate, current, and aligned with agency requirements. 3. The ISSO conducts security monitoring and supports incident response activities. a. Conduct system log reviews, monitor system activity for abnormal behavior or potential compromise. b. Review, analyze, and report on vulnerability and compliance scan results. c. Ensure continuous monitoring of implemented security controls. d. Participate in incident response activities, including investigation, reporting, and after-action documentation. 4. The ISSO coordinates with stakeholders and communicates system security requirements. a. Collaborate with ISOs, ISSMs, system administrators, engineers, and other stakeholders. b. Serve as a liaison with auditors, assessors, and external agencies during reviews. c. Provide security training and awareness to system owners & users as needed. d. Support contingency planning, testing, and disaster recovery activities. 5. The ISSO assists in developing, recommending, and validating security policies and procedures. a. Contribute to the development and review of cybersecurity policies and procedures. b. Ensure systems are operated, maintained, and disposed of in compliance with policy. c. Support supply chain risk management requirements and validate use of third-party software. 6. The ISSO supports system security throughout the full system development lifecycle. a. Provide advice on security requirements and architecture during design, development, and deployment for on-premises, hybrid, and cloud systems. b. Ensure controls remain effective through operations, sustainment, and system disposal. c. Reviews, recommends, and validates configuration and change management requests for assigned systems i. Participates in Configuration Control Boards (CCBs). ii. Review and assess the security impact of proposed system changes. iii. Ensure security reviews are documented and follow established policy. 7. The ISSO fulfills general responsibilities to ensure compliance and support oversight. a. Maintain positive working relationships with technical teams and stakeholders. b. Ensure security authorization and assessment activities are executed in accordance with policy and procedures. c. Support development of BIAs, PIAs, ISAs, and MOUs/A as required. d. Maintain current information in the client's Assessment & Authorization (A&A) tool (e.g., JCAM). e. Participate in security audits, assessments, and exercises. f. Report incidents, risks, and issues to ISSMs, CISOs, and other stakeholders. h. Support other duties as assigned by ISSMs or the CISO. Master's degree in any of the following disciplines (Information Technology, Cybersecurity, Data Science, Information Systems, or Computer Science), from an ABET accredited or CAE designated institution fulfills the educational requirement for this WRC. One-and-one- half (1.5) years of additional experience can substitute for one (1) year of a typical degree program. Minimum 10 years of experience in Information Technology (IT) and/or Information Security (IS). DoD 8140 certification for their respective area or the ability to obtain certification within six (6) months of onboarding. Active Secret Security Clearance Security Control Assessor intermediate certifications:

Responsibilities

The ISSO ensures compliance with cybersecurity standards and manages system risk while supporting the development and maintenance of security documentation. They conduct security monitoring, support incident response activities, and coordinate with stakeholders to communicate system security requirements.