Information System Security Officer; ISSO

Position Summary

The Information System Security Officer (ISSO) is responsible for leading, maintaining, and continuously improving the organization's cybersecurity compliance program. The position serves as the primary coordinator for CMMC Level 2 activities and works across all departments to ensure cybersecurity remains integrated into normal business operations.

• Serve as the primary owner and coordinator of the CMMC Level 2 compliance program and C3
  
  PAO assessment
• Maintain cybersecurity policies, procedures, documentation, and assessment
• Coordinate internal reviews, corrective actions, and continuous improvement
• Partner with the MSP and internal IT resources to ensure technical security controls remain effective and aligned with business needs.
• Support the protection of Controlled Unclassified Information (CUI) and related information
• Work with Quality to integrate cybersecurity into the quality management system.
• Support external assessments and cybersecurity-related compliance
• Provide cybersecurity awareness, guidance, and training across the
• Monitor regulatory and contractual cybersecurity requirements and recommend

• Current SSP with accurate system scope, boundary, asset inventory, data flows, control narratives, and
• Current POA&M with ownership, due dates, risk notes, remediation status, and closure
• CMMC Level 2 evidence library mapped to applicable practices and assessment
• Recurring control review calendar and completed review
• CUI handling procedure, CUI flow map, and department-specific work
• Training matrix and completion records for cybersecurity awareness, CUI handling, and user
• Internal audit results, corrective actions, and management review inputs related to
• Supplier and external service provider records relevant to CUI handling and cybersecurity

• Bachelor's degree in Cybersecurity, Information Technology, Computer Science, or Information Systems preferred. Equivalent combinations of education, certifications, and relevant work experience may be considered.

• Minimum 2 years of demonstrated cybersecurity or information technology experience supporting CMMC Level 2, NIST SP 800-171, DFARS , or equivalent CUI cybersecurity compliance requirements; experience in an AS9100D or regulated manufacturing environment preferred.

• Working knowledge of CUI handling, access control, MFA, endpoint protection, vulnerability management, incident response, configuration management, backup validation, logging, and account lifecycle management.
• Ability to create and maintain SSPs, POA&M, policies, procedures, evidence libraries, audit records, and corrective action
• Experience coordinating across IT, Quality, Engineering, Operations, HR, Purchasing, Contracts, and external service
• Strong documentation discipline and ability to translate cybersecurity requirements into practical manufacturing
• Ability to conduct internal reviews, identify gaps, assign corrective actions, and verify closure