Cyber Security SME

Overview

MAR Division of Oasis Systems has an exciting opportunity for a full time Cyber Security Subject Matter Expert with ten years or more experience. The Cyber Security Subject Matter Expert acts as a subject matter expert for our Federal customer within the nuclear energy sector as he or she implements and matures regulatory cyber security programs, contributing to both the government and industry. The Cyber Security Subject Matter Expert will actively support the agency as it establishes cyber security regulation and guidance to promote safety and security regulating special nuclear material.

NOTE:  Applicants who have worked for the nuclear power industry within the last year are not eligible.  Applicants who have worked for the nuclear power industry past a year may be eligible and are required to disclose the name of the company or companies, specify the work performed, and how long ago the applicant was employed.

REQUIRED QUALIFICATIONS: (Education, Certifications, Experience, Skills)

This candidate must have experience with the following:

• EXPERIENCE LEVEL: Minimum of 10 years of IT experience and cyber security experience a must. Experience working with government consulting, and a minimum of eight years’ experience leading audits preferred.
• EDUCATION: BA/BS degree in engineering, computer science, cyber security, or related fields, or equivalent.
• SECURITY CLEARANCE: Ability to obtain a DOE security clearance.
• TRAVEL: Occasional domestic travel 25%
• Communication Skills:
  • Ability to facilitate/participate in public meetings with the nuclear industry, where the press and other high visibility entities may be present
  • Ability to communicate both orally and in writing appropriate to the audience and political dynamic of a given situation
  • Strong writing skills and the ability to compose highly visible original documents that are relied upon by the nuclear industry
  • Ability to provide, verbally or in writing, a technical opinion or an interpretation of information based on in-depth and expert knowledge in a particular subject area
• Performed IT security audits
• Cyber security engineering principles

DESIRED QUALIFICATIONS: (Education, Certifications, Experience, Skills)

This candidate shall have experience with the following:

• Penetration testing to include footprinting, creating attack trees, and identifying attack vectors
• Various standard and non-standard (hacker community) security tools including strengths, weaknesses, and identifying marks/signatures
• Knowledge of digital components comprised of industrial control systems
• Supervisory Control and Data Acquisition (SCADA) Systems
• Distributed Control Systems (DCS)
• Safety Instrumented Systems (SIS)

JOB RESPONSIBILITIES: Functionally, the successful candidate will:

• The SME will participate in the cyber inspection process by analyzing the adequacy of the implementation of cyber security programs by licensees (entities with a license to handle nuclear materials). This participation will include assisting the NRC lead inspector in preparing for the frequent cyber inspections and aiding in identifying the critical systems and critical digital assets in need of inspection. 
• When preparing for a cyber inspection, the SME will review technical documentation provided by the licensee in response to the formal request for information letter. The SME will also analyze cyber vulnerability assessments and identify technical issues associated with a licensee assessment of digital critical systems or critical digital assets.
• After this stage of review and analysis, the SME will communicate to the inspection team the technical issues identified during the inspection process with a nexus to the regulatory basis and will write up justifications of the technical issues that could lead to potential findings during the inspection.
• In preparation for the onsite inspection stage, the SME will prepare all of his or her own travel arrangements for all inspection visits and submit a travel request form estimating expenses. During the onsite inspections, the SME will serve as a technical consultant to the lead inspector while demonstrating discernment, discretion, and humility in all interactions with NRC inspectors and employees. It is vital that the SME be able to balance providing expertise and depth of knowledge while still deferring to the inspection lead.
• The SME will demonstrate a knowledge of terms, policy, and guidance and be well versed in industry best practices. The SME will actively work with a variety of ICS standards and certifications, including ISA/IEC-62443 (Formerly ISA-99), IEEE 802.3, NERC Critical Infrastructure Protection (CIP) Standards, NRC Regulatory Guide 5.71, NEI 08-09, NIST Special Publications, and ISASecure Certifications. The SME will also frequently work with regulatory documents associated with the cyber security program such as Title 10 of the Code of Federal Regulations (10 CFR), Section 73.54. The SME will be expected to take the initiative to remain up-to-date with the latest industry standards. The position is an excellent opportunity to become an expert in the field.  
• After the onsite stage of the inspection, the SME will be responsible for writing up and submitting an expense report recording all travel expenses for reimbursement and will prepare for and participate in the Secure Information Forum to support the lead inspector’s findings.
• When not working directly on inspections, the SME will interact with various NRC project leads by spearheading a variety of innovative cyber initiatives, including writing, revising, and participating in meetings for regulatory guidance on various cyber security issues affecting the Nuclear Regulatory Commission. Other work with project leads will include developing responses to various technical issues that arise from the application of cyber security regulations and analyzing cyber security best practices and recommending how those practices are applicable to the program’s cyber security requirements. The SME will be expected to possess strong communication skills, including dynamic delivery, ability to tailor subjects to the audience, and a sense of diplomacy.
• The SME will also help to develop and present cyber security trainings so that NRC inspectors and staff may become more effective when assessing the NRC cyber security program at nuclear power reactor sites and successfully engage in oversight and enforcement activities. This work will include writing and designing course content and developing classroom and laboratory exercises related to the subject area.
• The SME will be responsible for performing general administrative tasks as well, including recording daily hours worked and filling out a daily status report summarizing activities associated with his or her assigned responsibilities, participating in a weekly contract status meeting, attending various team meetings that may arise, checking email accounts regularly, and completing annual security and inspection trainings. When not on travel, the SME is expected to be working on site at least 32 hours a week.

Who We Are

Oasis Systems is a premier provider of customer-driven, cost-effective and quality Engineering Services; Enterprise Systems and Applications; Human Factors Engineering; Information Technology and Cyber Security; Professional Services; and Specialized Engineering Solutions to the Department of Defense, FAA, NRC and other federal agencies.

We strive to be an exciting and welcoming company that attracts, develops, motivates and retains the most talented, skilled and dedicated people in the industry; where they are encouraged to achieve personal excellence, purpose, and their full potential and career aspirations; while supporting mission-critical national security technologies and programs.

MAR Division of Oasis Systems is an equal opportunity employer and does not discriminate in hiring or employment on the basis of any legally protected characteristic including, but not limited to, race, color, religion, national origin, marital status, gender, sexual orientation, ancestry, age, medical condition, military veteran status or on the basis of physical handicap which, with reasonable accommodation, render the application to satisfactorily perform the job available.