Info System Security Officer; ISSO

AMERICAN SYSTEMS is an employee-owned federal government contractor supporting national priority programs through our strategic solutions in the areas of Information Technology, Test & Evaluation, Program Mission Support, Engineering & Analysis, and Training.

We are seeking an Information System Security Officer (ISSO) to support a Network Operations Center Network Management Support Services. The ISSO will serve as a designated security professional for one or more FISMA systems of record and new information systems, supporting the Assessment and Authorization (A&A) lifecycle, Authority to Operate (ATO) activities, ongoing authorization, continuous monitoring, vulnerability management, and compliance with government security requirements.

This role will work closely with the Government Program Manager, Technical POC/Task Manager, Information Systems Security Manager (ISSM), COR, system owners, engineers, and security stakeholders.

• Perform ISSO duties in accordance with DHS 4300A, HB 1400-05D, FISMA guidance, applicable NIST publications, and approved program SOPs.
• Lead or support the Assessment and Authorization (A&A), reaccreditation, and continuous-monitoring processes for assigned information systems.
• Notify security leadership of upcoming accreditation or reaccreditation requirements and coordinate reaccreditation kickoff activities with the agency's Security Authorization Team.
• Support the transition of designated systems to Ongoing Authorization (OA), also known as continuous monitoring.
• Manage Plans of Action and Milestones (POA&Ms), including development, documentation, SME follow-up, remediation tracking, and status reporting.
• Review Information Security Vulnerability Management (ISVM) messages, determine applicability, acknowledge notifications, track remediation, and coordinate POA&M creation for unresolved vulnerabilities.
• Review weekly network scans and log information; prepare vulnerability summaries and identify critical and high-risk issues affecting assigned systems.
• Maintain accurate system asset inventories and provide updates to the Vulnerability Assessment Team (VAT); reconcile system inventories with DHS detailed asset reports.
• Review proposed change requests to verify that changes comply with security standards and update asset records and System Security Plans (SSPs) when systems or configurations change.
• Develop, review, maintain, and submit A&A and security documentation for Government approval, including SSPs, risk assessments, FIPS 199 categorization assessments, ST&E plans and results, ATO and ATT artifacts, contingency plans, ISAs, waivers, and POA&Ms.
• Review and update SSPs annually or when significant system changes occur; complete annual NIST SP 800-26 or NIST SP 800-53 assessments as required.
• Prepare documentation and support the annual Ongoing Authorization Review Management Board (OARMB), DHS/CISA/OMB audits, cybersecurity data calls, and FedRAMP or cloud-as-a-service activities, as applicable.
• Assist the Computer Security Incident Response Center (CSIRC) with investigations of security violations and incidents.
• Support encryption and security compliance requirements, including FIPS 197 AES-256, FIPS 140-2 validated cryptographic modules, NSA Type 1 or
• Type 2 encryption, PKI, and emerging FIPS 203, 204, and 205 requirements.
• Prepare weekly ISSO reports covering ATO activities, assessments, audits, change requests, POA&Ms, ISVMs, waivers, compliance highlights, and issues requiring management guidance.

• Senior ISSO candidates should demonstrate approximately 5–10 years of relevant information systems security, cybersecurity, or security authorization experience. Candidates supporting junior-level ISSO assignments.
• In-depth knowledge of the Risk Management Framework (RMF), NIST publications, FISMA, DHS 4300A, and HB 1400-05D.
• Assessment and Authorization:
  Demonstrated experience implementing or assessing NIST SP 800-53 controls and supporting A&A, ATO, reaccreditation, or continuous-monitoring activities.
• Experience reviewing Nessus or comparable vulnerability scans, tracking ISVMs, managing remediation, and developing or maintaining POA&Ms in an enterprise environment.
• Experience preparing or maintaining SSPs, security assessments, risk assessments, contingency plans, ST&E artifacts, ATO packages, waivers, and related security documentation.
• Understanding of enterprise networking concepts, infrastructure, architectures, and configuration changes.
• Ability to work…