Information Systems Security Officer (ISSO

Position Overview

The Information Systems Security Officer (ISSO) is responsible for the security, compliance, and operational integrity of MSI Defense Solutions' information systems supporting both classified and unclassified environments. The ISSO serves as the primary cybersecurity and information assurance lead, ensuring systems comply with DoD Risk Management Framework (RMF), NIST SP 800-171, NIST SP 800-53, CMMC, and other applicable federal security requirements.

The Information Systems Security Officer (ISSO) is responsible for the security, compliance, and operational integrity of MSI Defense Solutions' information systems supporting both classified and unclassified environments. The ISSO serves as the primary cybersecurity and information assurance lead, ensuring systems comply with DoD Risk Management Framework (RMF), NIST SP 800-171, NIST SP 800-53, CMMC, and other applicable federal security requirements. This position is responsible for maintaining Authorization to Operate (ATO) packages, supporting security assessments, implementing continuous monitoring activities, and safeguarding Controlled Unclassified Information (CUI) and classified information.

The ISSO partners closely with Information Technology, Security, Engineering, Program Management, and government customers to ensure cybersecurity requirements are integrated throughout the system lifecycle. The ISSO will report to the Digital Technology Manager. The position requires a full-time work week spent in the office or hybrid with 3 days onsite. Normal hours are Monday through Thursday 7:00am-4:30pm and Friday 7:00am - 12:00pm.

(Must be flexible to work additional hours as needed based on project requirements and deadlines.)

• Serve as the Information Systems Security Officer (ISSO) for classified and unclassified information systems.
• Maintain compliance with the DoD Risk Management Framework (RMF), NIST SP 800-53, NIST SP 800-171, CMMC, and applicable DoD cybersecurity policies.
• Develop, maintain, and update System Security Plans (SSPs), POA&Ms, Security Assessment Reports (SARs), and RMF documentation.
• Administer and maintain the organization's Governance, Risk, and Compliance (GRC) platform (e.g., IntelliGRC), ensuring security documentation, evidence, POA&Ms, and assessment artifacts remain current and audit ready.
• Support Authorization to Operate (ATO), Authority to Connect (ATC), and continuous monitoring activities.
• Ensure implementation and maintenance of required security controls across enterprise systems.
• Conduct vulnerability assessments, security audits, and remediation tracking.
• Coordinate vulnerability scanning, patch management, and secure system configuration.
• Investigate, document, and coordinate cybersecurity incident response activities.
• Administer user access controls and privileged account management in accordance with least privilege principles.
• Ensure compliance with security requirements for classified systems and secure facilities.
• Lead the preparation for internal audits, DCSA assessments, customer inspections, and CMMC assessments including evidence collection, artifact management, and assessor coordination.
• Collaborate with IT, Engineering, and Program teams to integrate cybersecurity throughout project execution.
• Develop and maintain cybersecurity policies, procedures, and user awareness initiatives.
• Support secure implementation of Microsoft 365 GCC High, Azure, Microsoft Defender, Intune, and related security technologies.
• Serve as the primary cybersecurity liaison for government customers and external auditors.
• Monitor compliance status, track remediation activities, and provide regular reporting on cybersecurity posture and outstanding compliance actions to leadership.

• Bachelor's degree in Cybersecurity, Information Technology, Computer Science, or related field (or equivalent experience).
• 5+ years of cybersecurity, information assurance, or information systems security experience within a DoD or federal contractor environment.
• Strong knowledge of:
• DoD Risk Management Framework (RMF)
• NIST SP 800-53
• NIST SP 800-171
• CMMC Level 2
• STIG…