Information System Security Officer

Bering Straits Native Corporation; Colorado Springs (CO); On-site; USD 81,000 - 120,000; Full time

Job summary

Bering Straits Native Corporation seeks an Information System Security Officer (ISSO) in Colorado Springs, CO. This role supports RMF activities, develops and maintains security documentation, and ensures compliance with DoD and federal cybersecurity requirements.

The successful candidate will have 3+ years in cyber information assurance, possess or be eligible for a Secret clearance, and work on-site. The position is contingent upon contract award and offers a competitive range

Qualifications

• Bachelor's degree in Cybersecurity, IT, CS, IS, Engineering, Math, or related field.
• Minimum 3 years of cybersecurity or information assurance experience.
• Experience with RMF compliance activities.
• Experience maintaining cybersecurity documentation and authorization artifacts.
• Experience implementing and assessing security controls on information systems.
• Experience supporting vulnerability management and security reviews.

Responsibilities

• Serve as Information System Security Officer (ISSO) for assigned information systems.
• Support RMF activities across the system lifecycle.
• Develop and maintain SSPs, POA&Ms, SARs and other cybersecurity docs.
• Ensure systems comply with DoD, Federal, IC cybersecurity requirements.
• Conduct security audits, vulnerability assessments, and self-inspections.
• Coordinate remediation efforts with system admins and cybersecurity staff.
• Review proposed hardware/software/config changes for security impact.
• Support ATO/ATC/IATT and related accreditation activities.
• Perform periodic reviews of user accounts, logs, and configurations.
• Investigate cybersecurity incidents and coordinate corrective actions.
• Support continuous monitoring programs and security scanning requirements.

Skills

RMF processes

NIST SP 800-53

Cybersecurity

Communication

Problem solving

Independent work

Education

Bachelor's degree in Cybersecurity or related field

Tools

eMASS

Xacta

ACAS

Nessus

Splunk

Microsoft Defender

Job description

Pay or shift range: $81,000 USD to $120,000 USD. The estimated range is the budgeted amount for this position. Final offers are based on various factors, including skill set, experience, location, qualifications and other job-related reasons.

Description

About this position: Information System Security Officer in Colorado Springs, CO

The Essential Duties and Responsibilities are intended to present a descriptive list of the range of duties performed for this position and are not intended to reflect all duties performed within the job. Other duties may be assigned. To perform this job successfully, an individual must be able to satisfactorily perform each essential duty. The requirements listed below are representative of the knowledge, skill and/or ability required. Reasonable accommodation may be made to enable individuals with disabilities to perform the essential functions of the position.

Applicants will be notified via email or phone within ten business days regarding application status.

This position is contingent upon award of contract.

• Serve as the Information System Security Officer (ISSO) responsible for implementing and maintaining cybersecurity and information assurance requirements for assigned information systems.
• Support Risk Management Framework (RMF) activities throughout the system lifecycle, including security control implementation, assessment, authorization, and continuous monitoring.
• Develop, maintain, and update System Security Plans (SSPs), Plan of Action and Milestones (POA&Ms), Security Assessment Reports (SARs), and other cybersecurity documentation.
• Ensure assigned systems operate in compliance with DoD, Federal, Intelligence Community, and organizational cybersecurity requirements.
• Conduct routine security audits, compliance reviews, vulnerability assessments, and self-inspections.
• Monitor system security posture and identify cybersecurity risks, vulnerabilities, and compliance deficiencies.
• Coordinate vulnerability remediation efforts with system administrators, engineers, and cybersecurity personnel.
• Review and evaluate proposed hardware, software, and system configuration changes for security impacts.
• Support Authorization to Operate (ATO), Authority to Connect (ATC), Interim Authorization to Test (IATT), and related accreditation activities.
• Perform periodic reviews of user accounts, privileged access, audit logs, system configurations, and security controls.
• Investigate cybersecurity incidents, security violations, and suspicious activity; document findings and coordinate corrective actions.
• Support continuous monitoring programs and ensure compliance with security scanning requirements.
• Maintain inventory and configuration management records for assigned systems.
• Provide cybersecurity training, awareness briefings, and guidance to system users and administrators.
• Coordinate with Information System Security Managers (ISSMs), Information System Security Engineers (ISSEs), Program Managers, and government stakeholders.
• Maintain cybersecurity records and generate compliance reports, security metrics, and status briefings.

Required (Minimum Necessary) Qualifications

• Education Requirements: Bachelor's degree in Cybersecurity, Information Technology, Computer Science, Information Systems, Engineering, Mathematics, or a related technical field. Additional years of qualifying experience may be substituted for education requirements.
• Level of Experience Requirements: Minimum of 3 years of experience supporting cybersecurity, information assurance, information security, systems administration, or related technical disciplines.
• Experience supporting Risk Management Framework (RMF) compliance activities.
• Experience maintaining cybersecurity documentation and authorization artifacts.
• Experience implementing and assessing security controls on information systems.
• Experience supporting vulnerability management and security compliance reviews.
• Experience monitoring information systems for cybersecurity compliance and risk.
• Must possess or be eligible to obtain and maintain a Secret security clearance; Top Secret clearance preferred.

Knowledge, Skills, Abilities, and Other Characteristics

• Knowledge of information system operations and cybersecurity best practices.
• Strong written and verbal communication skills.
• Ability to manage multiple priorities and work independently with minimal supervision.
• Working knowledge of NIST Risk Management Framework (RMF) processes.
• Familiarity with NIST SP 800-53 security controls and Department of Defense cybersecurity requirements.
• Knowledge of information assurance and cybersecurity principles.
• Understanding of Windows, Linux, virtualized environments, and enterprise network architectures.
• Familiarity with vulnerability management tools and security assessment methodologies.
• Knowledge of user account management, auditing, access controls, and configuration management practices.
• Understanding of encryption, Public Key Infrastructure (PKI), and identity management principles.
• Ability to analyze vulnerabilities and recommend effective remediation actions.
• Strong organizational, analytical, and problem-solving skills.
• Proficiency with Microsoft Office Suite and cybersecurity management tools.
• Knowledge of organizational procedures and workflows - understanding how work moves through a company.
• Basic knowledge of relevant technologies or tools - e.g., Microsoft 365, communication platforms, or industry-standard software.
• Knowledge of customer service practices - principles of providing quality service and managing inquiries professionally.
• Knowledge of data privacy and confidentiality principles - awareness of proper handling of sensitive information.
• Communication skills (written and verbal) - ability to convey information clearly and professionally.
• Time management and prioritization - balancing multiple tasks and meeting deadlines.
• Problem-solving and critical thinking - analyzing issues and selecting appropriate solutions.
• Interpersonal and teamwork skills - building rapport and collaborating effectively with others.
• Attention to detail - producing accurate, error-free work.

Preferred

• Active Secret, Top Secret, or TS/SCI security clearance.
• Current DoD 8570/8140 certification such as Security+, CISSP, SSCP, CAP, CASP+, or equivalent.
• Experience supporting Air Force, Space Force, Army, Navy, Intelligence Community, or other Federal Government organizations.
• Experience supporting classified information systems and secure network environments.
• Familiarity with eMASS, Xacta, ACAS, Nessus, Splunk, Microsoft Defender, or similar cybersecurity tools.
• Experience supporting Special Access Programs (SAPs) or Sensitive Compartmented Information (SCI) systems.
• Knowledge of cloud security concepts and environments including Azure Government and AWS GovCloud.
• Experience supporting continuous monitoring programs and cybersecurity inspections.
• Prior experience as an ISSO, System Administrator, Cybersecurity Analyst, Information Assurance Analyst, or Security Specialist.
• Familiarity with configuration management, change management, and incident response processes.

Necessary Physical Requirements

The physical demands described here are representative of those that must be met by an employee to successfully perform the essential functions of this role. Employees must always maintain a constant state of mental alertness. Reasonable accommodation may be made to enable individuals with disabilities to perform the essential functions.

• Must be able to sit and work at a computer workstation for extended periods (frequently).
• Must be able to review, analyze, and maintain cybersecurity documentation and technical records (frequently).
• Must be able to communicate effectively during meetings, audits, inspections, and technical reviews (frequently).
• Must be able to conduct physical inspections of systems, equipment, and facilities as required (occasionally).
• Must be capable of lifting up to 20 pounds of computer equipment, documentation