Job Title: Information Systems Security Engineer (ISSE) – Systems Security Analyst

Employment Type: Full-Time – Up to 40 hours per week
Employment Status: Contingent Upon Contract Award
Customer Agency: Naval Facilities Engineering Systems Command (NAVFAC) Marianas – Command Information Office (CIO3 Office)

Work Location: On-Site

Place of Performance:

• Naval Facilities Engineering Systems Command (NAVFAC) Marianas facilities:
• • Building 205, Halsey Drive, Nimitz Hill, Piti, Guam 96915.
  • Building 3179, Sumay Drive, Naval Base Guam, Santa Rita, Guam 96915.
• Additional Government facilities as required:
• • Marine Corps Base Camp Blaz, Guam.
  • Andersen Air Force Base, Guam.

Position Overview

·       The Information Systems Security Engineer (ISSE) will provide cybersecurity engineering support to the Naval Facilities Engineering Systems Command (NAVFAC) Marianas Command Information Office (CIO). The ISSE will support the protection, operation, and continuous improvement of Facility-Related Control Systems (FRCS) by ensuring the confidentiality, integrity, availability, and security of Government information systems, networks, and data.

·       The successful candidate will execute cybersecurity engineering activities supporting the Risk Management Framework (RMF), Authority to Operate (ATO) authorization processes, vulnerability management, continuous monitoring, security assessments, and cybersecurity risk management activities across NAVFAC Marianas installations.

·       This position requires demonstrated experience supporting Department of the Navy (DoN) and Department of Defense (DoD) cybersecurity environments, including RMF implementation, NIST SP 800-53 security controls, eMASS authorization package management, vulnerability assessments, Security Technical Implementation Guide (STIG) compliance, Plan of Action and Milestones (POA&M) management, and configuration management activities.

·       The ISSE will work independently with minimal Government supervision and serve as a mission-essential cybersecurity resource supporting cybersecurity operations, Configuration Control Board (CCB) activities, and Cyber Emergency Response Team (CERT) functions.

Essential Duties and Responsibilities

• Execute Risk Management Framework (RMF) lifecycle activities (Steps 1–6) in accordance with applicable Department of the Navy (DoN), Department of Defense (DoD), and NAVFAC Echelon II cybersecurity guidance.
• Review and validate:
• • System inventories.
  • Security documentation.
  • Authorization artifacts.
  • Compliance evidence.
  • RMF package information.
• Support Authority to Operate (ATO) authorization activities for Facility-Related Control Systems (FRCS), including:
• • Maintaining and tracking authorization packages.
  • Supporting annual security reviews.
  • Preparing and maintaining Memorandums for Record (MFRs) for approved baseline changes during RMF Step 6 activities.
• Develop, maintain, and update cybersecurity documentation, including:
• • System Security Plans (SSPs).
  • Security policies.
  • Standard Operating Procedures (SOPs).
  • Implementation plans.
  • After-action reports.
  • Cybersecurity-related technical documentation.
• Apply NIST SP 800-53 security controls and tailor cybersecurity requirements to FRCS operational environments.
• Develop and execute vulnerability management strategies using approved DoD and Department of the Navy cybersecurity processes.
• Perform vulnerability and compliance assessments using approved cybersecurity tools, including:
• • ACAS/Nessus.
  • Security Content Automation Protocol (SCAP).
  • Evaluate STIG.
  • Security Center.
  • Vulnerability Remediation Asset Management (VRAM).
• Perform manual Security Technical Implementation Guide (STIG) and Security Requirements Guide (SRG) compliance validation using:
• • .ckl files.
  • .cklb checklist formats.
• Generate cybersecurity assessment reports and maintain vulnerability documentation, including: