Info System Security Officer (ISSO)

AMERICAN SYSTEMS; Ashburn (VA); On-site; USD 111,000 - 185,000; Full time

Job summary

AMERICAN SYSTEMS is seeking an Information System Security Officer (ISSO) in Ashburn, VA to support a Network Operations Center and manage the A&A lifecycle, continuous monitoring, and security documentation for multiple FISMA systems. The role requires RMF/NIST expertise, experience with ATO/POA&Ms, vulnerability management, and coordination with government program managers and security stakeholders.

A Bachelor's degree in cybersecurity or related field is preferred; security certifications are

Qualifications

• Experience with RMF, NIST, FISMA, DHS 4300A, and HB 1400-05D.
• Experience implementing or assessing NIST SP 800-53 controls and supporting A&A/ATO/continuous-monitoring.
• Experience reviewing vulnerability scans, tracking ISVMs, and developing POA&Ms.
• Experience maintaining SSPs, security assessments, risk assessments, and contingency plans.
• Bachelor’s degree or equivalent experience in a related field.
• Understanding of enterprise networking concepts and configurations.
• Ability to work with Government and customer organizations and communicate security issues clearly.

Responsibilities

• Lead A&A, reaccreditation, and continuous-monitoring for assigned information systems.
• Coordinate reaccreditation kickoff activities with the agency’s Security Authorization Team.
• Support transition to Ongoing Authorization and continuous monitoring.
• Manage POA&Ms including remediation tracking and status reporting.
• Review ISVMs and vulnerability reports; coordinate remediation.
• Maintain asset inventories and update SSPs as systems/configurations change.
• Prepare A&A and security documentation for Government approvals.

Skills

RMF Knowledge

NIST Publications

A&A Experience

Vulnerability Mgmt

Security Docs

Teamwork

Communication

Education

Bachelor’s Degree in Cybersecurity

Tools

Nessus

Job description

Overview

AMERICAN SYSTEMS is an employee-owned federal government contractor supporting national priority programs through our strategic solutions in the areas of Information Technology, Test & Evaluation, Program Mission Support, Engineering & Analysis, and Training.We are seeking an Information System Security Officer (ISSO) to support a Network Operations Center Network Management Support Services. The ISSO will serve as a designated security professional for one or more FISMA systems of record and new information systems, supporting the Assessment and Authorization (A&A) lifecycle, Authority to Operate (ATO) activities, ongoing authorization, continuous monitoring, vulnerability management, and compliance with government security requirements. This role will work closely with the Government Program Manager, Technical POC/Task Manager, Information Systems Security Manager (ISSM), COR, system owners, engineers, and security stakeholders.

Responsibilities

• Perform ISSO duties in accordance with DHS 4300A, HB 1400-05D, FISMA guidance, applicable NIST publications, and approved program SOPs.
• Lead or support the Assessment and Authorization (A&A), reaccreditation, and continuous-monitoring processes for assigned information systems.
• Notify security leadership of upcoming accreditation or reaccreditation requirements and coordinate reaccreditation kickoff activities with the agency's Security Authorization Team.
• Support the transition of designated systems to Ongoing Authorization (OA), also known as continuous monitoring.
• Manage Plans of Action and Milestones (POA&Ms), including development, documentation, SME follow-up, remediation tracking, and status reporting.
• Review Information Security Vulnerability Management (ISVM) messages, determine applicability, acknowledge notifications, track remediation, and coordinate POA&M creation for unresolved vulnerabilities.
• Review weekly network scans and log information; prepare vulnerability summaries and identify critical and high-risk issues affecting assigned systems.
• Maintain accurate system asset inventories and provide updates to the Vulnerability Assessment Team (VAT); reconcile system inventories with DHS detailed asset reports.
• Review proposed change requests to verify that changes comply with security standards and update asset records and System Security Plans (SSPs) when systems or configurations change.
• Develop, review, maintain, and submit A&A and security documentation for Government approval, including SSPs, risk assessments, FIPS 199 categorization assessments, ST&E plans and results, ATO and ATT artifacts, contingency plans, ISAs, waivers, and POA&Ms.
• Review and update SSPs annually or when significant system changes occur; complete annual NIST SP 800-26 or NIST SP 800-53 assessments as required.
• Prepare documentation and support the annual Ongoing Authorization Review Management Board (OARMB), DHS/CISA/OMB audits, cybersecurity data calls, and FedRAMP or cloud-as-a-service activities, as applicable.
• Assist the Computer Security Incident Response Center (CSIRC) with investigations of security violations and incidents.
• Support encryption and security compliance requirements, including FIPS 197 AES-256, FIPS 140-2 validated cryptographic modules, NSA Type 1 or
• Type 2 encryption, PKI, and emerging FIPS 203, 204, and 205 requirements.
• Prepare weekly ISSO reports covering ATO activities, assessments, audits, change requests, POA&Ms, ISVMs, waivers, compliance highlights, and issues requiring management guidance.

Qualifications

• Senior ISSO candidates should demonstrate approximately 5–10 years of relevant information systems security, cybersecurity, or security authorization experience. Candidates supporting junior-level ISSO assignments.
• In-depth knowledge of the Risk Management Framework (RMF), NIST publications, FISMA, DHS 4300A, and HB 1400-05D.
• Assessment and Authorization: Demonstrated experience implementing or assessing NIST SP 800-53 controls and supporting A&A, ATO, reaccreditation, or continuous-monitoring activities.
• Experience reviewing Nessus or comparable vulnerability scans, tracking ISVMs, managing remediation, and developing or maintaining POA&Ms in an enterprise environment.
• Experience preparing or maintaining SSPs, security assessments, risk assessments, contingency plans, ST&E artifacts, ATO packages, waivers, and related security documentation.
• Understanding of enterprise networking concepts, infrastructure, architectures, and configuration changes.
• Ability to work effectively in a team environment, build rapport with Government and customer organizations, and communicate technical security issues clearly.
• Education: Bachelor’s degree in cybersecurity, information assurance, computer science, information systems, or a related field is preferred; equivalent relevant experience may be considered.

Preferred Qualifications

• Experience supporting a federal or other mission-critical enterprise network operations environment.

Security Clearance

• Ability to obtain Public Trust, Preferred Secret/Top Secret Clearance

Certifications

• CISSP, Security+, Network+, CISA, CAP, or security auditing certification recommended.

Pay Transparency Statement

AMERICAN SYSTEMS is committed to pay transparency for our applicants and employee-owners. The salary range for this position is USD $110,800.00/Yr. - USD $185,100.00/Yr. Actual compensation will be determined based on several factors permitted by law.

AMERICAN SYSTEMS provides for the welfare of its employees and their dependents through a comprehensive benefits program by offering healthcare benefits, paid leave, retirement plans, insurance programs, and education and training assistance.

EEO Statement

EEO Race/Sex/Disability Status/Veteran Status