Information Systems Security Officer; ISSO

The Information Systems Security Officer I (ISSO I) supports the security and compliance of information systems and networks in accordance with applicable government, customer, and organizational requirements. Working under supervision, the ISSO I assists with system authorization activities, maintenance of System Security Plans and related documentation, security control implementation and assessment, vulnerability scanning, continuous monitoring, and incident reporting. The position collaborates with program managers, system administrators, security engineers, and internal and external customers throughout the system life cycle.

The ISSO I also supports procedures for the protection, handling, and accountability of classified systems, media, and equipment and helps ensure that system changes are properly documented and reviewed.

• Performs routine information system security tasks under the guidance of senior security personnel and established procedures.
• Assists with preparing, maintaining, and updating System Security Plans, security control documentation, risk assessments, Plans of Action and Milestones, and other authorization artifacts.
• Supports system authorization and continuous monitoring activities by gathering evidence, tracking documentation, and coordinating required updates.
• Conducts or assists with vulnerability scans, reviews results, documents findings, and supports remediation tracking and validation.
• Monitors assigned systems for compliance with approved security configurations, access requirements, and operating procedures.
• Assists with reviewing proposed hardware, software, configuration, account, and network changes for security impact and required documentation.
• Supports user account reviews, access authorization, security training records, audit log reviews, and other recurring security activities.
• Assists with identifying, documenting, reporting, and mitigating suspected security incidents in accordance with established procedures.
• Helps implement and maintain procedures for the protection, control, storage, transfer, and disposition of classified media and equipment.
• Communicates security requirements and findings to technical staff, program personnel, customers, and other stakeholders in a clear and professional manner.
• Maintains organized and accurate security records and provides status updates on assigned tasks, findings, and corrective actions.
• Keeps current on applicable cybersecurity requirements, organizational policies, and security tools relevant to assigned systems.
• Escalates complex, high-risk, or non-routine issues to senior security personnel or management.
• Knowledge of basic cybersecurity principles, including confidentiality, integrity, availability, least privilege, defense in depth, and risk management.
• Working knowledge of information system security controls, authorization documentation, continuous monitoring, vulnerability management, and incident response concepts.
• Familiarity with government and Department of Defense cybersecurity and classified information system requirements applicable to the assigned environment.
• Basic knowledge of Windows and/or Linux operating systems, networks, user account administration, security configurations, audit logs, and common security tools.
• Ability to interpret and follow security policies, technical guidance, standard operating procedures, and customer requirements.
• Ability to prepare and maintain accurate security documentation, records, spreadsheets, reports, and system artifacts.
• Ability to identify routine security issues, gather relevant information, apply established procedures, and escalated matters appropriately.
• Ability to use vulnerability scanning, endpoint security, log review,…