BAE Systems is looking for an experienced ISSE to join our technology-based program supporting a key Government customer. You will perform the following activities:

• Document the various security control implementations as well as gather the artifacts that support the Risk Management Framework (RMF) and ICD 503 Security Accreditation for various Assessment and Authorization (A&A) efforts

• Document and obtain a general understanding of the architecture being developed or that was developed for each project in order to write the Systems Security Plans (SSP)/CONOPS in the Greenlight application.

• Gather the information by working with various team members in order to write various additional A&A related documents such as Contingency Plan (CP), General User Guide (GUG), Privileged User Guide (PUG), Standard Operating Procedures (SOP’s), etc.

• Support Accreditation and Authorization (A&A) reviews by ISSO/M, as well as the Security Controls Assessor (SCA)

• Document the Plans of Actions and Milestones (POA&Ms) implementation responses or mitigations, as well as provide all required artifacts (i.e. evidence gathering from the teams)

• Coordinate with various contractor and staff personnel to obtain the A&A content, as well as working with various customer security organizations to navigate the customer’s A&A process in order to achieve Authority to Develop (ATD), Interim Authority to Operation (IATT), as well as Authority to Operate (ATO).

• Keep track of where each of the various A&A projects are within the customer’s A&A process in order to know when it’s time to re-submit for accreditation or an accreditation extension.

• A minimum of five (5) years relevant experience
• Previous ISSE experience directly supporting the customer
• Experience leading an ATO initial or reacreditation effort
• Possess multi-tasking skills, as well as be a good communicator/facilitator
• Knowledge of complex network environments involving shared networks and multiple security enclaves
• Possess the ability to bridge the technical implementation into commonly understood security verbiage
• Experience in Cloud security control implementation, PKI implementation, STIG compliance and vulnerability management, and Security Development and Operations (SecDevOps)
• Various security tools and reports such as Greenlight, RoadRunner, Rapid 7, WebInspect, App Detective, and Splunk
• Public, private and hybrid Cloud experience (AWS, Microsoft Azure, etc.)

• CISSP, or GSLC