Information System Security Officer (ISSO)

Job description

**This position is listed on behalf of a partner company, which manages all applications and next steps. Our partner is looking for an Information System Security Officer (ISSO) based in the United States.** Join a mission-driven cybersecurity team dedicated to protecting critical Department of Defense (DoD) information systems and enabling secure, reliable enterprise IT operations. As an Information System Security Officer, you will oversee information system security compliance, risk management, continuous monitoring, and authorization documentation across classified environments. You will work closely with system owners, security leadership, and government stakeholders to implement security policies, mitigate vulnerabilities, and maintain operational readiness. Your expertise will support compliance with DoD security frameworks, NIST standards, and Department of the Air Force continuous monitoring requirements. This role combines hands-on cybersecurity oversight, technical problem-solving, and collaboration across enterprise IT service delivery and security operations. Working remotely within the United States, you will contribute to high-impact national security missions while helping teams maintain strong security practices throughout the system lifecycle. ### Accountabilities - **Information system security oversight:** Ensure that information systems comply with established security policies, operational procedures, and applicable organizational requirements. Verify that access requirements are met and that signed Acceptable Use Agreements are maintained. - **Security policies and procedures:** Assist in developing, reviewing, distributing, and maintaining information assurance policies, implementation plans, technical guidance, and standard operating procedures. Ensure documentation addresses applicable NIST SP 800-53 Revision 5 security control families. - **Risk management and authorization:** Support the development, maintenance, and review of system certification, accreditation, assessment, and authorization documentation in accordance with the DoD Risk Management Framework (RMF) or applicable DIACAP requirements. - **Continuous monitoring and assessments:** Conduct continuous monitoring activities aligned with the Department of the Air Force's continuous authorization methodology and support the Continuous Monitoring and Risk Assessment (CORA) process, including security assessments, risk identification, documentation, and mitigation tracking. - **Vulnerability management:** Review security bulletins and advisories, including those from relevant response teams and the Defense Information Systems Agency (DISA). Track Information Assurance Vulnerability Alerts (IAVAs), report implementation status, and help ensure vulnerabilities are addressed within required timeframes. - **Configuration management and change control:** Ensure that procedures governing hardware, software, and firmware changes comply with configuration management policies. Coordinate proposed modifications with the appropriate security personnel and approval authorities before implementation. - **Security incident response:** Identify, investigate, document, and report security incidents and policy violations to the Information System Security Manager (ISSM), Information Assurance Manager, Security Incident Response Team, and relevant management personnel. Initiate approved protective and corrective measures when incidents or vulnerabilities are discovered. - **Security controls and data protection:** Evaluate security requirements related to confidentiality, integrity, and availability, ensuring appropriate protection levels and safeguards are maintained across assigned systems. - **System lifecycle security:** Ensure security requirements are incorporated throughout every phase of the information system lifecycle and that current security documentation remains accessible to authorized personnel. - **Governance and change advisory participation:** Participate in Change Advisory Board and Demand Approval Board activities, contributing security expertise to change assessments, risk decisions, and approval processes. - **Technical reporting and stakeholder engagement:** Provide clear, accurate updates on system security posture, vulnerability remediation, continuous monitoring, and compliance status to government stakeholders. Represent the security function in formal briefings when the ISSM is unavailable. - **Team coordination and continuous improvement:** Collaborate with system owners, security leaders, and technical teams to resolve security issues, support sprint objectives, and strengthen organizational security practices. - **Professional development:** Complete required technical and cybersecurity training related to operating systems, networking, system administration, and security management. ## Requirements - **Professional experience:** At least 12 years of relevant experience. A bachelor's degree in a related field may substitute for five years of relevant experience, subject to the position's qualification requirements. - **Security clearance:** An active DoD Secret security clearance is required. - **Cybersecurity certification:** Current DoD 8570 Information Assurance Technical (IAT) Level II certification or an applicable qualifying certification is required. - **DoD security frameworks:** Familiarity with the DoD Risk Management Framework (RMF), DIACAP processes, and associated security assessment and authorization requirements. - **Classified environments:** Demonstrated experience working with classified information systems and understanding the security controls required to protect sensitive government information. - **Security compliance and documentation:** Ability to develop and maintain security policies, assessment documentation, authorization packages, continuous monitoring records, and vulnerability remediation reports. - **Vulnerability and risk management:** Understanding of security advisories, vulnerability tracking, incident response, risk assessment, and corrective action processes. - **Technical security knowledge:** Working knowledge of information system functions, security policies, technical safeguards, operational security measures, and configuration management practices. - **Cloud and DevSecOps:** Experience with cloud environments and DevSecOps practices, including integrating security considerations into technical workflows and system development activities. - **Communication skills:** Strong technical writing and verbal communication skills, with the ability to produce accurate documentation, present security status updates, and communicate complex technical information to government and technical stakeholders. - **Leadership and autonomy:** Ability to work independently with limited supervision, coordinate team activities, guide colleagues, and help deliver sprint commitments and organizational priorities. - **Analytical and organizational skills:** Strong judgment, attention to detail, and the ability to manage competing priorities while maintaining compliance with security requirements. - **Preferred eMASS experience:** Familiarity with the Enterprise Mission Assurance Support Service (eMASS) for security assessment and authorization management. - **Preferred VDI knowledge:** Experience with virtual desktop infrastructure (VDI) environments and their associated security requirements. - **Preferred CORA expertise:** Knowledge of the Department of the Air Force's Continuous Monitoring and Risk Assessment process and its documentation and compliance expectations. - **Preferred IT service management knowledge:** ITIL Foundation certification or familiarity with IT service management principles and processes. - **Travel and work arrangement:** Ability to work remotely from any U.S. state and travel within the continental United States as required, with travel of up to 10%. ## Benefits - **Competitive salary:** Proposed annual salary range of **$90,300–$189,600**, depending on location, experience, qualifications, certifications, and applicable contract requirements. - **Comprehensive healthcare:** Access to healthcare benefits designed to support employees and their families. - **Financial and retirement benefits:** Financial wellness resources and retirement benefit options. - **Flexible time off:** A flexible time-off benefit designed to support work-life balance. - **Wellness resources:** Programs and resources supporting employee health and well-being. - **Family support:** Benefits and resources intended to help employees manage personal and family needs. - **Professional development:** Access to learning resources, continuing education, and opportunities to expand cybersecurity expertise. - **Career growth:** Opportunities to contribute to complex national security programs and develop expertise in enterprise cybersecurity, risk management, and security compliance. - **Remote work:** A remote work arrangement available across the United States, with up to 10% travel as required. - **Mission-driven environment:** The opportunity to protect critical information systems and contribute to secure, reliable IT services supporting national defense missions. - **Inclusive workplace:** Equal employment opportunities for qualified applicants, regardless of protected characteristics.