Information Systems Security Officer - Security

York Space Systems was founded to radically improve spacecraft affordability and reliability, transforming and enabling next‑generation space mission operations worldwide. Today, York is one of the most innovative aerospace companies, specializing in end‑to‑end customer solutions and the rapid production of spacecraft platforms. York’s complete Space Segment Solution includes spacecraft production, payload integration, system integration & test, launch services, ground segment services, and mission operations, enabling customers to leverage York’s existing technology solutions to get to orbit rapidly and responsively.

We’re looking to expand our team across the board.

The selected candidate will lead and coordinate A&A (Authorization & Assessment) efforts across multiple systems’ RMF lifecycle, supporting multiple RMF accreditation efforts and performing tasks such as determining DoD requirements, managing hardware/software configuration, conducting risk and vulnerability assessments, testing and documenting security controls, and ensuring overall compliance with DoD Cybersecurity policies. The role requires experience as an ISSO or security‑related field, comfortable operating in a senior role and mentoring junior ISSOs.

The ISSO will speak directly with customers with minimal ISSM involvement, acting as the face of security for their selected boundaries.

• Oversee day‑to‑day operations required to perform RMF.
• Delegate tasks and create deadlines to meet security requirements.
• Act as forward facing for customer interactions translating into system requirements.
• Spearhead building RMF packages within eMASS and perform continuous monitoring for the full lifecycle.
• Implement the RMF process across the entire A&A lifecycle, supporting all efforts pre and post ATO determination.
• Assist the ISSM in meeting their duties and coordinate with the system’s Security Controls Assessor (SCA) and Authorizing Officer (AO).
• Perform and review technical security assessments to identify vulnerabilities, non‑compliance and recommend mitigation strategies.
• Conduct risk analyses from vulnerability, compliance scans, penetration testing results and other audit activities.
• Create and maintain POA&Ms, SSPs, SCTMs, SOPs, Configuration Management Plans, Contingency Plans and Test Result/Security Impact Analyses.
• Ensure approved procedures for clearing, sanitizing and destroying hardware and media.
• Conduct continuous monitoring activities for applicable authorization boundaries.
• Apply and maintain up‑to‑date application of STIGs to required components of the information systems.
• Maintain inventory and asset configuration, including change management documentation.
• Lead system‑level change request through formalized Configuration Control Boards (CCB).
• Keep the appropriate operational security posture and collaborate with system owner and ISSM.
• Notify ISSM when changes may affect the authorization determination.
• Advise system administrators on remediation of system deficiencies.
• Report all security‑related concerns and incidents to the ISSM.
• Handle security concerns in lieu of ISSM as per system procedures.

• Experience developing and documenting DoD Assessment and Authorization documentation.
• Knowledge of CNSSI 1253, NIST 800 Series (primarily 800‑53, 800‑53A, 800‑171), RMF.
• 3+ years of IA/Cyber Security experience.
• Bachelor’s degree or higher in Computer Science or Security.
• Security+ certification, CEH or equivalent.
• Experience with DCSA tools such as eMASS, STIGs and SCAP.
• US Citizenship and Active TS clearance or higher.

• Familiar with RMF package creation and maintenance artifacts to support A&A decision.
• Experience using DISA STIGs, SRGs, and SCAP to audit and securely configure network‑enabled devices.
• Fundamental knowledge of DISA eMASS.
• Familiar with vulnerability tools and audit review tools (Nessus and Splunk preferred).
• Ability to advise ISSOs/ISSEs or relevant security personnel to remediate system deficiencies.
• Experience conducting risk analysis on products and system components via CVEs, plugins, CWEs.
• Experience in conducting software…