ConvoCourses

Cyber Security Compliance and IT Jobs

risk management framework

remote opportunity cybersecurity risk management framework RMF job

by Leave a Comment

check out the Cyber Security & IT Resume course:
https://securitycompliance.thinkific.com/courses/resume-marketing-for-cyber-security-it
Coupon code: resumefeb2020
50% off (expires 29 Feb 2020)

check out the remote work course:
https://securitycompliance.thinkific.com/courses/find-it-remote-work

Check out the job:
Job Title: Cybersecurity Risk Management Framework SME
Location: #RemoteJob (#WorkfromHome)
Duration: 12 Months (Contract-to-Hire)
Job Description:
Active Secret Clearance Required

· KBRwyle is seeking candidates with Risk Management Framework (#RMF) experience to join a team of experienced RMF professionals that supports the Defense Health Agency (DHA).

Position Description:

· Primary responsibility is to perform tasks related to Assessment & Authorization (A&A) and cybersecurity under the Defense Health Agency (DHA) to obtain and maintain Authorizations to Operate (ATOs) for assigned DoD medical systems (i.e., applications, networks, devices). This position will be a part of a team developing recommended courses of action needed to transition current policies and procedures to the DHA RMF-approved processes.

Primary Responsibilities:

· Provide solutions to complex problems that require the regular use of expertise and creativity. Problems are broadly defined and solutions require the continuation of specialized theories and knowledge

· Serve as Subject Matter Expert (SME) on one or more technologies/skills related to A&A activities

· Conduct risk and vulnerability assessments of information systems to identify vulnerabilities, risks, and protection needs

· Actively participate in working group meetings to identify, plan, and execute strategies in response to emerging cybersecurity/RMF policies

· Attend and participate in regular A&A status meetings to facilitate progress and address potential issues of RMF system efforts

· Maintain awareness and knowledge of evolving security and risk management standards and communicate and apply relevant changes to existing processes

Day-to-day tasks are contingent on related experience and assigned role, and may include the following:

· Develop, update, and/or review RMF documentation to include Security Plans, Implementation Plans, Plans of Action and Milestones (POA&Ms), and Risk Assessment Reports

· Assess system compliance against NIST, DoD, and DHA security requirements to include the NIST 800-53 controls and DISA Security Technical Implementation Guides (STIGs) and Security Requirements Guides (SRGs)

· Produce evidence as necessary to support compliance status of NIST, DoD, and DHA security requirements

· Work with system administrators, engineers, and developers to create or update system/site policies, procedures, and process guides

Minimum Qualifications:

· BS degree and six (6) years of experience with Cybersecurity / Information Technology, or twelve (12) years of hands-on experience with Cybersecurity / Information Technology

· Demonstrated efficiency and experience in one or more of the following areas:

· RMF package development, including POA&Ms (mitigation statements), Security Plans, Risk Assessments, system/site policies, procedures, and processes, architecture diagrams, and hardware and software inventories

· Assured Compliance Assessment Solution (ACAS) and Host Based Security System (HBSS)

· DISA STIGs/SRGs validation

· NIST 800-53 control validation

· Continuous Monitoring and Risk Scoring (CMRS)

· RMF policy development and strategy implementation

· BIOMED experience (former technician, physician, engineer, etc.) installing, testing, using, maintaining, designing, and/or modifying medical equipment and applications

· Demonstrated experience with Risk Management Framework (experience under DHA a plus)

· Excellent customer service and organization skills

· Excellent oral and written communication skills

· Familiarity with NIST publications

· Active DoD Secret security clearance

· DoD 8570-compliant (CompTIA Security+ certified)

· Ability to obtain OS certification or complete approved related training within 180 days of hire

· Ability to travel up to 25-35%

· Experience with eMASS

360 Mt. Kemble Avenue, Suite 2000 | Morristown, NJ 07960
Office: 973.507.7582 | Fax: 973.998.2599
siddartha.s@artech.com | www.artech.com

NIST SP 800-53, Revision 5 Security Controls for Information Systems and Organizations – 1 overview

by Leave a Comment

NIST SP 800-53, Revision 5 Security Controls for Information Systems and Organizations – 1 overview

To download the slide go to:
https://securitycompliance.thinkific.com

NIST Special Publication 800-53, Revision 5
Security and Privacy Controls
Final Public Draft: October 2018
Final Publication: December 2018
Source: https://csrc.nist.gov/projects/risk-m…

NIST Special Publication 800-53A, Revision 5
Assessment Procedures for Security and Privacy Controls
Initial Public Draft: March 2019
Final Public Draft: June 2019
Final Publication: September 2019

There are 6 major objectives for this update—
-Making the security and privacy controls more outcome-based by changing the structure of the controls;

-Fully integrating the privacy controls into the security control catalog creating a consolidated and unified set of controls for information systems and organizations

-Separating the control selection process from the actual controls: systems engineers, software developers, enterprise architects; and mission/business owners

-Promoting integration with different risk management and cybersecurity approaches and lexicons, including the Cybersecurity Framework

-Clarifying the relationship between security and privacy to improve the selection of controls necessary to address the full scope of security and privacy risks

IT security position job Q&A (part 1)

by Leave a Comment

Check out my FREE courses at: https://securitycompliance.thinkific.com

In this video we read some of your questions about getting IT Security Jobs.

masaki23joe
“I have a B.A in Telecommunications, would this work for this career field.” see the answer at 00:00:45

shawn 08
“Hey Bruce I got my security + and cap. What do you suggest on how to get into the risk management/ security auditing field when someone doesn’t have any experience? I do have 7 years experience in desktop support and data center monitoring just want to try a different field but not sure how to go about this.”
answer at 00:02:53

David petrell
“What training is need to get into the security field? I have a BS in information security and working a MS in Cybersecurity and working on getting my CEH cert. What are ways that I can get into the security field as I don’t have any security experience and most jobs postings are wanting at least 4 to 5 years of experience”
answer at 00:06:26

NIST 800 37 Revision 2 – RMF for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy

by Leave a Comment

NIST 800 37 Revision 2 Risk Management Framework for Information Systems and Organizations A System

Download the presentation in this Video & Learn more here:

http://securitycompliance.thinktific.com

This is an overview of NIST 800-37 Revision 2. I discuss the changes, the sources and Cybersecurity Framework.

NIST Special Publication 800-37, Revision 2
Risk Management Framework for Security and Privacy
Initial Public Draft: May 2018
Final Public Draft: July 2018
Final Publication: October 2018

NIST 37-800 Rev 2:
http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-37r1.pdf

Executive Order:
https://www.whitehouse.gov/presidential-actions/presidential-executive-order-strengthening-cybersecurity-federal-networks-critical-infrastructure/

OMB:
https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/memoranda/2017/M-17-25.pdf

Cybersecurity Framework:
https://www.nist.gov/sites/default/files/documents/cyberframework/cybersecurity-framework-021214.pdf

NIST SP 800-53 (Revision 5):
https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/draft

Source of Changes:
President’s Executive Order on Strengthening the Cybersecurity of Federal Networks and Critical Infrastructure
Office of Management and Budget Memorandum M-17-25 – next-generation Risk Management Framework (RMF) for systems and organizations
NIST SP 800-53 Revision 5 Coordination

Cyber security Engineer in Monterey CA

by Leave a Comment

This is Nicholas associated with 22nd Century Technologies, Inc.,(TSCTI) assessed at CMMI Level 3 is one of fastest growing IT services and solutions company with innovative approach to provide IT services and solutions to Federal, State, Local agencies and commercial clients. Incorporated in 1997, TSCTI has its corporate headquartered in New Jersey and has presence in 33 other states across the U.S including Public sector practice headquarter in DC Metro area. Find more about us at www.tscti.com
We have a position for you to work as Cyber security Engineer in Monterey CA. Please review below the full job and let us know if interested I will love to call you as per your convenience and would discuss this position in detail so that we can go ahead and submit your resume.
Please send me the updated copy of your detailed resume.
You can reach me at 908-765-0002 ext. 307 for any questions, I’m available today till 6 PM EST
Title:                                     Cyber security Engineer
Location:                             Monterey, CA
Duration:                             Full Time
Client:                                  Defense Language Institute
Certification : Security+
Duties may include:
•             Support an Information Systems Security, Education, Training, and Awareness Program.
•             support implementation and enforcement of Information Security Policies and Procedures.
•             Review and update all Information Systems Security Plans/SSPs and support certification and accreditation efforts.
•             Provide technical support in the areas of vulnerability assessment, risk assessment, and security implementation.
Technical Skills:
HBSS
ACAS
STIG
Retina, MacAfee
DIACAP
Thanks & Regards,
Nicholas Johnson
Team Lead

IT Security Career Risk Management Framework

by Leave a Comment

So you want to get into Information Technology? Well what do you want to do in IT because there are many different branches of it. I would suggest going into IT security, specifically, Risk Management Framework. It is a very specialized field.

You will need to know the fundamental of IT security. The basics on what goes into securing important data and their hardware. You will also need to have at least a little knowledge of technology and its history. You will need to know a LOT about NIST SP 800-37, “Guide for Applying the Risk Management Framework to Federal Information Systems”. You will need to dive into NIST SP 800-53, “Security and Privacy Controls for Federal Information Systems and Organizations”.

Since not many people want to do this work, or even know about it, there is not much competition. They are always looking for qualified people to do it. What you will need is a 4 year degree (preferably in something technical), an IT certification in security (Security+, ISC2 CAP, CISSP, CASP, CISM,CISA) and a lot of knowledge on NIST 800-37.