Information Systems Security Officer; ISSO

Position: Information Systems Security Officer (ISSO)
Location: Northern

# Information Systems Security Officer (ISSO)
Peraton  
· peraton.com Category:
GRC & Compliance

Location:

Chantilly, VASalary:
$104,000 – $166,000

Clearance:
TS/SCI## Quality of life

What the posting states. Hover or tap a perk to see the line it came from.
* 25 days PTOResponsibilities

Peraton is seeking a Mid-Level Information Systems Security Officer (ISSO) in Chantilly, VA to support our Department of Defense customer as part of a highly talented, highly motivated, and high-performing team. As part of the cybersecurity team, you will support Assessment and Authorization (A&A) activities for information systems operating within a DoD Special Access Program (SAP) environment. The position requires extensive knowledge of the Joint Special Access Program Implementation Guide (JSIG) and demonstrated experience implementing the Risk Management Framework (RMF) throughout the system lifecycle.

What you'll do:

Support the prepare, categorize, select, implement, assess, authorize, and monitor phases of the RMF lifecycle for information systems operating within a DoD SAP environment.

Interpret and apply JSIG policy and guidance to system security requirements, security control implementation, assessment activities, authorization packages, and continuous monitoring.

Develop, review, and maintain system security plans (SSPs), security control traceability matrices (SCTMs), plans of action and milestones (POA&Ms), risk assessments, continuous monitoring strategies, contingency plans, incident response plans, and supporting authorization artifacts.

Develop and maintain security control implementation statements that accurately describe how technical, operational, and management controls are implemented within the system and its operating environment.

Collect, review, and validate technical and nontechnical evidence demonstrating security control implementation and effectiveness.

Coordinate security control assessments, authorization activities, periodic reviews, annual assessments, and continuous monitoring activities with system owners, engineers, administrators, assessors, and Authorizing Official (AO) representatives.

Support authorization package submissions, assessment preparation, evidence reviews, discrepancy resolution, and responses to Security Control Assessor (SCA) and AO questions.

Identify cybersecurity risks, document control deficiencies, recommend corrective actions, and track remediation activities through closure.

Develop and maintain POA&Ms containing accurate weakness descriptions, risk determinations, remediation strategies, milestones, scheduled completion dates, and closure evidence.

Review vulnerability scan results, DISA Security Technical Implementation Guide (STIG) findings, configuration compliance results, audit records, and other cybersecurity data to determine risk and authorization impact.

Review system architectures, network diagrams, data flows, authorization boundaries, hardware and software inventories, ports, protocols, services, external connections, and system interconnections for accuracy and compliance.

Evaluate proposed hardware, software, architecture, configuration, service, and interconnection changes to determine cybersecurity, A&A, security control, and authorization boundary impacts.

Participate in configuration control boards, engineering reviews, security working groups, technical exchange meetings, and cybersecurity risk discussions.

Advise system administrators and engineers on security control implementation, STIG hardening, vulnerability remediation, and authorization requirements.

Communicate the system security posture, unresolved weaknesses, operational risks, and recommended mitigation actions to the ISSM and appropriate program leadership.

Qualifications

Require…