Information Systems Security Officer

The Information Systems Security Officer will lead cybersecurity efforts for complex software projects within a United States Department of Defense (DoD) environment, with a strong focus on Risk Management Framework (RMF) compliance and secure cloud-based workloads. This role drives the creation, submission, and maintenance of security packages and authorizations, including obtaining and sustaining Authorization to Operate (ATO) for Amazon Web Services (AWS) container-based solutions.

The position requires deep expertise in DoD cybersecurity processes, tools, and standards, as well as strong communication and collaboration skills across engineering, cybersecurity, business, and customer stakeholders.

• Serve as an Information Systems Security Engineer (ISSE) for DoD software projects, providing cybersecurity leadership and guidance across the full system lifecycle.

• Generate and submit complete System Security Packages (SSPs), Plans of Action and Milestones (POA&Ms), and other required artifacts to support DoD Risk Management Framework (RMF) and Security Technical Implementation Guide (STIG) processes.

• Apply DoD cybersecurity tools, including eMASS and STIG Viewer, to build, manage, and validate security packages and supporting documentation.

• Obtain and maintain at least one DoD Authorization to Operate (ATO) for AWS-deployed container-based workloads, ensuring ongoing compliance with DoD security requirements.

• Inform and define software mitigation requirements based on results from static application security testing (SAST) tools such as Sonar Qube and container scanning tools such as Trivy.

• Recommend and validate data protection mechanisms, including encryption and access control strategies, to safeguard sensitive information in deployed workloads.

• Test and verify security controls to ensure they function as designed and effectively reduce risk across applications and infrastructure.

• Conduct threat modeling activities to identify potential attack vectors and prioritize security mitigations for software systems and cloud workloads.

• Lead vulnerability management activities, including identifying, tracking, and coordinating remediation of security findings across development and operations teams.

• Monitor the security posture of deployed workloads, leveraging appropriate tools and processes to detect and respond to anomalous or malicious activity.

• Collaborate effectively with engineering, cybersecurity, business, and customer stakeholders throughout the RMF cybersecurity lifecycle, ensuring clear communication of risks, requirements, and progress.

• Provide security guidance and input to Dev Sec Ops  teams across multiple software releases, helping integrate security best practices into continuous integration and deployment processes.

• Use system security tools such as Wiz or eMASSter to support security posture assessment, reporting, and ongoing compliance activities.

• Contribute to the design and operation of Security Operations Center (SOC) functions, using tools such as Splunk or Cloud Watch to support monitoring and incident response.

• Leverage AWS security services, including Security Hub and Guard Duty, to strengthen detection, response, and compliance capabilities in cloud environments.

• Apply knowledge of CIS benchmarks and other industry security standards to align system configurations and controls with recognized best practices.

• Support or coordinate activities related to penetration testing, fuzz testing, and dynamic application security testing (DAST), and use results to drive remediation and improvement.

• Document security requirements, decisions, and outcomes clearly and comprehensively to support audits,…