Information Assurance Cyber Lead (ISSO)

As an Information Assurance Cyber Lead (ISSO) at CGI Federal, your primary responsibilities will include developing and maintaining comprehensive cybersecurity strategies, collaborating with key stakeholders, and managing security frameworks like NIST 800-37. You will also be responsible for incident response management, conducting regular security assessments, and mentoring a team of cybersecurity professionals.

To become an Information Assurance Cyber Lead at CGI Federal, you are required to have a Bachelor's Degree in Cyber Security, IT, Computer Science, or a related field. Additionally, you should have a minimum of 8-10 years of experience in cybersecurity, with at least 3 years in a leadership role, along with an active Top-Secret clearance.

The work environment for the Information Assurance Cyber Lead at CGI Federal in Newport News, VA, is dynamic and collaborative. You'll be part of a team that leverages Agile methodologies, allowing for quick adaptation to customer requirements and fostering a culture of innovation and continuous learning.

Yes, as an Information Assurance Cyber Lead at CGI Federal, you will have access to ample opportunities for professional development, including training programs, mentorship, and tuition assistance. The company values growth and encourages employees to pursue learning opportunities.

CGI Federal understands the importance of work-life balance and offers flexible work arrangements and paid time off, which allows Information Assurance Cyber Leads to manage their professional and personal commitments effectively.

Sure! The NIST 800-37 Risk Management Framework is essential for managing risk in federal information systems. It involves steps such as categorizing information systems, selecting security controls, implementing them, assessing their effectiveness, authorizing system operation, and continuously monitoring security controls.

In my previous role, I successfully led a team of cybersecurity professionals by fostering an environment of open communication and collaboration. I focused on mentoring team members, empowering them to take ownership of tasks, and encouraging continuous improvement through regular training and team-building exercises.

I approach incident response with a structured methodology, ensuring that incidents are promptly detected, evaluated, and escalated if necessary. I prioritize communication with key stakeholders, documenting the incident thoroughly and reviewing response effectiveness to improve future protocols.

I use a combination of qualitative and quantitative risk assessment methods, identifying vulnerabilities through regular security assessments and penetration testing. I prioritize risks based on their potential impact and probability, updating mitigation measures continuously as threats evolve.

Continuous monitoring is vital in my cybersecurity strategy, as it allows for real-time detection of anomalies and policy violations. Leveraging advanced tools, I analyze alerts and incidents, ensuring our cybersecurity measures adapt to new threats and vulnerabilities as they arise.

At my last company, I developed a comprehensive data protection policy that introduced encryption standards, user access controls, and protocols for data disposal. This policy significantly reduced data breach incidents and enhanced our compliance with industry regulations.

I possess extensive knowledge of cloud security principles, having worked with various cloud platforms such as Azure and AWS. I understand not just the security controls necessary to protect data in the cloud, but also the regulatory frameworks, such as FedRAMP, that govern their use.

I favor using tools like Nessus and Qualys for vulnerability scanning. They provide comprehensive coverage of known vulnerabilities and allow for customizable reporting, making it easier to prioritize remediation based on the organization’s risk profile.

To ensure compliance, I implement a robust governance framework that includes regular audits, security assessments, and policy reviews. I keep myself updated on relevant regulations and standards, applying necessary changes to our processes to remain compliant.

User training is crucial in cybersecurity, as human error is often a weak point in security measures. I advocate for regular security awareness training sessions to educate users about potential threats, social engineering tactics, and best practices for safe internet behavior.