Cybersecurity Specialist

Summary/ Objective

The Cyber Security & Compliance Specialist is responsible for enforcing governance to REDAR’s System Security Plan and Policies and auditing departments and processes for compliance to the company’s security policies.  The Cyber Security & Compliance Specialist is responsible for monitoring and addressing current trends in cyber security requirements.  The Cyber Security & Compliance Specialist is responsible for providing user training for the company’s System Security Plan and related policies, Cyber Security training and Cyber Risk Awareness training.  The Cyber Security & Compliance Specialist will work with third party security services as required.

Essential Functions

• Provide governance to ensure compliance to legal and regulatory requirements including dictated customer requirements.
  • Implementation, and retention of IT policies, processes and systems required to satisfy CMMC (including NIST 800-171) compliance
  • Collaborate with business units to develop and implement processes & procedures to support regulatory and customer dictated security requirements.
  • Provide evidence/supporting documents to attest to individual requirements of CMMC and NIST 800-171
  • Provide data required for Supplier Performance Risk System (SPRS)
  • Review and update System Security Plan (SSP) to reflect current requirements
  • Review and update Plan of Action and Milestones (POAM) to reflect current status for meeting/retaining CMMC certification
  • Work with CMMC Ecosystem Resources to attain/retain CMMC certification
• Cybersecurity Maturity Model Certification (CMMC) and NIST 800-171 Compliance & Governance
• Annual attestation coordination
• Supplier Vendor Compliance – Follow Up on Questionnaire
• Monitoring of CMMC related FAR/DFAR clauses
• Develop and execute process to Audit departments and users for compliance
• Maintain and update REDAR’s System Security Policy (SSP) and related security policies
• Change agent for updating, communicating and training users to revised requirements for the SSP and related policies
• Cyber Security/Disaster Recovery and Business Continuity Planning
• Employ best practices for security with least level of access required
• Stay abreast of current and trending threats by attending training, conferences and trade shows, etc.
• Retain External Services for Cybersecurity
• Routinely review monitoring notifications from External Service providers (as applicable) to review current Cyber Intel
• Collaborate with Information Technology & Systems Manager to implement and support requirements for qualification of Cybersecurity Insurance
• Collaborate with Information Technology & Systems Manager and Technical Support Manager to implement proactive solutions to prevent against new threats as they become known
• Oversee and direct company communication and education to provide user awareness of ongoing threats and risks
• Ensure that system patches/updates to operating systems & clients are implemented
• Collaborate with Information Technology & Systems Manager to ensure company data Backup, Disaster Recovery and Business Continuity Plan are current and documented
• Oversee user access security policy
• Collaborate with Technical Support Manager to develop and oversee appropriate security procedures to safeguard the system from physical harm and viruses, unauthorized users and damage to data
• Retain incident response plan
• Provide Cyber Security, Controlled Unclassified Information (CUI), Risk Awareness and IT policy training
  • Onboarding
  • Annual
• Develop and maintain training media for cyber security requirements, CUI and risk awareness
• Train employees in cyber security requirements, CUI, risk awareness and company security policies
• Ongoing current cyber threat awareness training
• Ongoing training on revisions to REDAR’s Information Systems Security Policy (ISS)  and related policies
• Actively monitor endpoints for suspicious activity
• Respond and take action to remediate threats in a timely manner
• Work with contracted External Cybersecurity providers as required
• Work with Technical Support Manager and technical team as required

• Monitor and address current trends in cyber security requirements
• Monitor appropriate security procedures to safeguard the system from physical harm and viruses, unauthorized users and damage to data
• Current awareness of upcoming security and compliance requirements relating to NIST 800-171 and CMMC

Competencies (Knowledge, Skills, Abilities)

This position requires strong organizational skills, analytical skills, a high level of attention to detail and knowledge of current requirements for compliance.  Good communications skills are required with the ability to work with all levels of the organization diplomatically and skillfully.

Supervisory Responsibilities

This position works under minimal supervision. Assignments are received in the form of results expected, due dates and general procedures to follow. This position has no supervisory responsibilities.

Work Environment

Standard climate-controlled office environment with moderate noise from computers, printers, and light foot traffic. Occasional exposure to varying temperatures, loud machinery, moving mechanical parts, and airborne particles.

Position Type and Expected Hours of Work

Regular full-time position expected to work an average of 40 hours per week throughout the course of the year. Core hours are a 9/80 schedule; Monday–Thursday, 7:00 AM to 4:30 PM. Working Fridays - 7:00 AM to 3:30 PM. Every other Friday - off. You will be expected to be on call outside of core hours as the primary contact for cyber incident responses.

Travel

This position requires an on-site presence at our Tucson, AZ office, and has minimal travel requirements. This position is eligible for a hybrid remote work schedule with the expectation of being in office 2x per week.

Required Education, Experience, Certification

• Bachelor degree in Computer Sciences, Information Systems or a specialized cybersecurity program, which will provide foundational knowledge in network security, risk management, cryptography, and threat detection
• Minimum three years’ experience in the following areas
• Monitoring and remediating Cyber Security threats
• Implementation and retention of Corporate policies
• Training employees on Cyber Security policies and awareness
• Windows server administration
• Microsoft Entra ID administration
• Microsoft Office 365 & Exchange administration
• Previous experience with NIST 800-171 compliance (or equivalent) required
• Previous employment with a Department of Defense Contractor preferred

• Medical, Dental and Vision
• Paid Time Off
• 401K with company match
• 9/80 Schedule (Off every other Friday)
• NOI (Quarterly Profit sharing)