Information Technology Security Specialist

p(SAIC is an equal opportunity employer and all qualified applicants will receive consideration for employment without regard to race, color, religion, sex, national origin, disability status, protected veteran status, or any other characteristic protected by law. SAIC is committed to a drug-free workplace. SAIC participates in E-Verify. SAIC will provide the federal government with Form I-9 information from all new employees. SAIC is an Equal Opportunity/Affirmative Action Employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, disability, or status as a protected veteran.)

SAIC is seeking an Information System Security Officer (ISSO) — IT Security Specialist, Level I — to support the security and compliance of government information systems in Oklahoma City, OK. This is an on-site, full-time role.

About the role

Under close supervision, the ISSO will apply basic technical knowledge to perform system certifications, accreditations, and information security tasks. The role supports the Risk Management Framework (RMF) lifecycle, including continuous monitoring, vulnerability management, and compliance documentation.

Responsibilities

• Apply basic technical knowledge in support of system certifications, accreditations, and information security tasks under close supervision.
• Assist in developing, documenting, reviewing, and maintaining RMF security documentation, including:
  • System Security Plans (SSPs)
  • Contingency Plans (ISCPs)
  • Incident Response Plans (IRPs)
  • Business Impact Analyses (BIAs)
  • System Characterization Documents (SCDs)
  • Configuration Management Plans (CMPs)
  • Privacy Impact Analyses (PIAs)
  • Plan of Action & Milestones (POA&Ms)
  • Account Management Plans (AMPs)
  • Security Impact Analyses (SIAs)
• Create, track, and maintain POA&Ms for multiple information systems; collaborate with stakeholders and ISSMs to ensure accurate documentation, remediation, and communication.
• Assist in conducting risk analysis of planned and installed information systems to identify vulnerabilities and threats; recommend mitigation actions.
• Assist in vulnerability scanning of information systems; compile compliance reports based on scan findings; validate scan accuracy and identify false positives.
• Assist in developing security contingency plans, disaster recovery procedures, and incident response training.
• Gather artifacts and support Continuous Monitoring Assessments, Security Assessments, and internal/external security audits.
• Provide cybersecurity guidance to project teams and stakeholders through system development, configuration, and maintenance.
• Prepare and present status reports on findings, POA&M progress, and RMF activities to management and stakeholders.

Qualifications

• Bachelor’s degree in Computer Science, Information Systems, Information Technology, Cybersecurity, or a related discipline. Four years of relevant experience may substitute for the degree.
• Must be able to obtain a Public Trust Clearance prior to the start date.
• Minimum of three (3) years of combined IT experience, including at least one of the following:
  • Installing, maintaining, or managing IT network devices, physical/virtual servers, or operating system/database platforms (e.g., Linux, Windows, UNIX, Solaris, Oracle, SQL, MySQL).
  • Supporting information systems as an Information Security or Cybersecurity professional.

Skills

• Working knowledge of NIST SP 800-30, 800-37, 800-40, and 800-53, and/or other RMF frameworks.
• Familiarity with common vulnerability scoring systems (e.g., CVSS) and vulnerability scanning tools (e.g., Nessus, Qualys).
• Ability to differentiate between software flaws and misconfiguration issues.
• Strong written and verbal communication skills; ability to work effectively across technical and non-technical teams.
• Strong attention to detail with excellent organizational and documentation skills.

The following credentials and experience, while not required, will strengthen a candidate’s application:

• One or more certifications: Security+, SSCP, CAP/CGRC, CISA, CISSP, or GSEC.
• Experience with RMF system lifecycle documentation and implementation.
• Experience with cybersecurity or information system tracking tools.
• Knowledge of configuration management and change control processes.
• Proficiency with Microsoft Office Suite.