Information Systems Security Officer Resume Example

• Implement Risk Management Framework (RMF) in accordance with NIST SP 800-37
• Coordinated with System Owners to categorize information system into Low, Moderate and High using FIPS 199 and NIST 800-60 as a supplemental guidance
• Selected system security controls based on the categorization using FIPS 200 and NIST 800-53 as a supplemental guidance.
• Manage the Assessment and Authorization of Five (5) systems.
• Ensure security policies, procedures and recommendations comply with FISMA, NIST, Organizational guidelines and technical best practices.
• Developed, reviewed, and updated Information Security System Policies, System Security Plans, and Security baselines in accordance with NIST, FISMA, OMB App. III A-130 and industry best security practices. Applied appropriate information security control for Federal Information System based on NIST 800-37 rev1, SP 800-53, FIPS 199, FIPS 200 and OMB A-130 Appendix III.
• Develop a variety of Assessment & Authorization deliverables including; System Security Plan (SSP), Security Assessment Report (SAR), Contingency Plan (CP) and Continuous Monitoring Plan for review and approval for Authorization Official.
• Led team to prepare, collate, remediate and validate security artifacts in order to pass ATO audits
• Created and updated other documents such as System Categorization (FIPS199), Audit Policy and Procedure, Incidence Response Plan (IRP), ISCP/IRP After Action Report, Media Protection yearly before Re-Authorization of the systems or whenever there are changes to the systems.
• Responsible for reviewing documents from the assessors such as Executive Summary, Risk Assessment Report (RAR), Security Assessment Plan (SAP), Status Report and Ongoing Authorization Document.
• Develop Plan of Action and Milestones (POA&M) for identified vulnerabilities and ensure compliance and remediation through monthly updates.
• Prepare quarterly POA&Ms documents and ensure they are signed by the System Owners.
• Provide ongoing gap analysis of current policies, practices, and procedures as they relate to established guidelines outlined by NIST, OMB, and FISMA.
• Manage all phases of software development lifecycle to include analysis, design,development and testing while maintaining appropriate controls.
• Manage change control to ensure the integrity of the solutions deployed and prevent unauthorized changes.
• Ensure alignment between information security program and other business functions to support integration with business processes.
• Ensure that risk assessments, vulnerability assessments and threat analysis are conducted periodically and consistently to identify risks.
• Present identified risks to system Stakeholders and ISSM monthly to ensure the timely remediation.
• Provide ongoing Continuous Monitoring to assigned systems using Nessus, IBM BigFix, Solarwinds, DBProtect, WebInspect and Netsparker.
• Create and manage security and awareness oversight and training as required.
• Create business continuity/disaster recovery plans, to include conducting disaster recovery tests, publishing test results, and making changes necessary to address deficiencies.
• Assisting System Owners in establishing and implementing the required security safeguards to protect computer hardware, software, and data from improper use or abuse.
• Fostering communication and collaboration among system stakeholders to share knowledge and to better understand threats to information.
• Responsible for preparing the Risk Acceptance Memo(RAM) and ensure that it is signed by the System Owner and the Authorizing Official
• Generated, reviewed and submitted system security package to FedRAMP for systems hosted in a cloud environment.
• Reviewed scan reports identified critical vulnerabilities and coordinated with system owners to remediate vulnerabilities.

·