Information System Security Officer; ISSO

Position: Information System Security Officer (ISSO)
Basic Qualifications

Bachelor's degree in Engineering, or a related Science or Mathematics field, plus a minimum of 2 years of relevant experience; or Master's degree, plus 6 months relevant experience.

CLEARANCE REQUIREMENTS:

Department of Defense Secret security clearance is required at time of hire. Applicants selected will be subject to a U.S. Government security investigation and must meet eligibility requirements for access to classified information. Due to the nature of work performed within our facilities, U.S. citizenship is required.

Responsibilities for this Position

What Sets You Apart Communicate technical cybersecurity topics clearly and effectively to diverse technical and non-technical audiences.

Create an environment where the business and mission impact of cybersecurity, continuous monitoring, and risk decisions is clearly understood.

Partner effectively with engineering, operations, and program teams to implement cybersecurity technologies, principles, and secure system practices.

Apply a strong security mindset, including the ability to question system behavior, configurations, or operational activities that are inconsistent with security requirements and principles.

Exercise sound judgment, initiative, and attention to detail when identifying, communicating, and driving corrective actions for cybersecurity risks.

Representative Duties and Tasks Serve in an Information System Security Officer (ISSO)-type capacity, supporting the system’s cybersecurity posture throughout development, deployment, operations, and sustainment.

Perform continuous monitoring activities in accordance with RMF and program requirements, including reviewing security logs, audit records, alerts, vulnerability results, configuration changes, and security-relevant events.

Analyze security events and log data to identify anomalous activity, potential indicators of compromise, control deficiencies, and compliance concerns; coordinate escalation and response activities as appropriate.

Work with system development, deployment, and operations teams to implement and maintain secure system architectures, designs, configurations, and operational procedures.

Champion the cybersecurity perspective in decisions related to the implementation, assessment, operation, and verification of security controls.

Support the development, maintenance, and execution of Continuous Monitoring (Con Mon) plans, including recurring security control assessments, evidence collection, status reporting, and risk tracking.

Produce and maintain cybersecurity design documentation, system security documentation, security operating procedures, and other artifacts supporting authorization and ongoing system security.

Produce and maintain the Security Control Traceability Matrix (SCTM), inheritable control sets, and control implementation statements to support test traceability and audit readiness.

Lead or support NIST SP 800-37 Risk Management Framework (RMF) activities to develop and maintain the body of evidence required for security authorization and ongoing authorization activities.

Coordinate with development, test, system administration, and operational teams to plan, implement, assess, and document security requirements and controls.

Track security findings, vulnerabilities, control deficiencies, and remediation activities; support development and maintenance of Plans of Action and Milestones (POA&Ms).Review and map evidence from applicable security requirement sources—including STIGs, NCDSMO, DISA guidance, and customer requirements—within the SCTM and RMF evidence package.

Support system accreditation/certification evaluation and test activities to ensure technical security features—including identification, authentication, access control,…