Information Technology Security Threat and Risk Assessment and Certification and Accreditation

Threat and Risk Assessment and Certification Analyst

Support the delivery of a Software as a Service (SaaS) Collaborative Environment utilizing Office 365, Portable Diagnostic and Maintenance Tools, an interim Interactive Electronic Technical Manual, an Electronic Information Exchange (EIE) and software and hardware required for the in-service support of the project’s deliverables. The Collaborative Environment will also be utilized to facilitate the implementation of the Conditions Based Maintenance System, a Technical Problem Management System, as well as a Synchronization Through Web Portal for updating Portable Diagnostic and Maintenance Tools.

Tasks

-Collaborate with all stakeholders on the evaluation of any relevant data from service providers, transformation teams, project management teams, and contractors
-Analyze and evaluate project requirements and documentation
-Review business and IT Security requirements from Project Statement of Work, acquisition contract, current IT security requirements and Security Assessment and Authorization process; Review contractor provided deliverables and plans related to IM/IT security, or IM/IT systems being implemented on behalf of the project, such as Collaborative Environment Plan, IM/IT Management Plan, IM/IT Disaster Recovery Plan, Software Configuration Management Data Sets and Software Management Plan
-Assist in the review and validation of deliverables related to Contractor developed IT solutions to ensure DND IT security regulations are adhered to
-Contribute to the development of Security Assessment & Authorization Artifacts (Statement of Sensitivity, Concept of Operations, Threat Assessments).
-Participate in related IT Security meetings, discussions and presentations to stakeholders or senior management
-Participate in related IT Security meetings, discussions and presentations to stakeholders or senior management
-Verify that security safeguards meet the applicable policies and standards; Validate the security requirements by mapping the system-specific security policy to the functional security requirements, and mapping the security requirements through the various stages of design documents
-Verify that security safeguards have been implemented correctly and that assurance requirements have been met. This includes confirming that the system has been properly configured, and establishing that the safeguards meet applicable standards; Conduct security testing and evaluation (ST&E) to determine if the technical safeguards are functioning correctly; and Assess the residual risk provided by the risk assessment to determine if it meets an acceptable level of risk. Conduct Accreditation activities such as, review of the certification results in the design review documentation by the Accreditation Authority to ensure that the system will operate with an acceptable level of risk and that it will comply with the departmental and system security policies and standards and identify the conditions under which a system is to operate (for approval purposes)
-The resource must prepare and submit deliverables resulting from the services provided, including but not limited to, the following: SA&A artefacts such Security Assessment Plan, Business Needs for Security, Statement of Sensitivity, Threat Assessment as specified by the Technical Authority (TA). The resource must provide a draft of the deliverables specified by the Technical Authority or the designated representative for review and approval. The scope and specific content of each deliverable must be included in the draft. All deliverables must be prepared in accordance with Government of Canada Accessibility Standards

Mandatory Skills

-Must clearly demonstrate that the proposed resource has at least five (5) years of IM/IT Security work experience, along with graduation from a recognized post-secondary institution in a minimum two-year program specializing in computer science, information technology, information management or a P. Eng certification. In lieu of the post-secondary education, an additional (2) two years of work experience in the IM/IT security realm, for a combined total of 7 years work experience, would be accepted.
-Must clearly demonstrate that the proposed resource has a minimum of three (3) years’ experience performing certification and accreditation (C&A) activities for Government of Canada systems including the production of the associated Certification reports, documents and related correspondence. C&A task experience must include but is not limited to: Information/system sensitivity assessments, completion of/or evaluation of threat and risk assessments completed in conformance with Communication Security Establishment Canada (CSEC) and Information Technology Security Guidance (ITSG-04), Harmonized Threat and Risk Assessments (HTRA), security architecture design reviews, vulnerability assessments, C&A plans, security audits, and security testing and evaluation

-On-site work in Ottawa
-Secret Federal Security Clearance required
-1-year contract

This posting is for a public sector assignment. Compensation will be determined through the competitive bidding process and will be within the approved rate structure for this assignment.