Information System Security Officer (ISSO)

ASEC; Lexington Park (MD); In loco; USD 125.000 - 140.000; Tempo pieno

Vantaggi offerti da questo lavoro

Employee ownership (ESOP)

401(k) with company match

Tuition assistance

Comprehensive benefits

Descrizione del lavoro

ASEC’s Information Systems Security Officer role is based at our Lexington Park, MD office, with up to 10% travel. You will support RMF assessments, maintain SSPs, and coordinate with DoD cyber staff to ensure compliance and authorization. You will develop evidence for eMASS, perform vulnerability reviews with ACAS/STIGs, and track POA&Ms while guiding remediation with IT teams.

A TS clearance is required. Required are a BS in a cybersecurity/IT field, 5+ years of IA experience, and hands-on DoD

Competenze

• Bachelor’s degree in Cybersecurity, Information Technology, Computer Science, Information Systems, or a related technical field.
• At least 5 years of IA/Cybersecurity experience is preferred.
• Experience supporting cybersecurity compliance, vulnerability management, or assessment and authorization activities for DoD information systems.
• Working knowledge of RMF, NIST SP 800-53 security controls, and DoD cybersecurity requirements.
• Experience developing and maintaining authorization documentation, security control evidence, and POA&Ms.
• Experience using ACAS, DISA STIGs, and SCAP tools to assess system security and support vulnerability remediation.
• Familiarity with eMASS or comparable cybersecurity assessment and authorization repositories.
• Working knowledge of Windows and Linux operating systems, networking fundamentals, access controls, and system hardening.

Mansioni

• Support RMF activities throughout the system lifecycle, including security control implementation, assessment preparation, authorization, and continuous monitoring.
• Develop, update, and maintain cybersecurity documentation, including SSPs, control implementation statements, supporting evidence, and authorization artifacts.
• Maintain system security records and authorization documentation in eMASS or other Government-designated repositories.
• Coordinate with technical teams to maintain inventories, boundary descriptions, network diagrams, and configuration baselines.
• Perform and review vulnerability assessments using ACAS, STIGs, and SCAP.
• Evaluate scan results and STIG findings, coordinate remediation, and validate corrective actions.
• Develop and maintain POA&Ms, track remediation progress, and prepare mitigation statements for Government review.
• Monitor compliance with cybersecurity policies and configurations; review changes for cybersecurity impacts.
• Coordinate cybersecurity requirements for system installations, upgrades, integration, and deployments.
• Review security logs and monitoring information and coordinate follow-up actions.
• Report suspected cybersecurity incidents and assist with evidence collection and corrective actions.
• Support inspections, security control assessments, and authorization reviews by organizing evidence and tracking follow-up.
• Up to 10% travel will be expected.

Conoscenze

RMF

NIST SP 800-53

ACAS

STIGs

eMASS

Windows

Linux

Vulnerability Management

Coordination

Formazione

Bachelor’s degree in Cybersecurity/IT/CS/IS/related field

Strumenti

ACAS

DISA STIGs

SCAP

eMASS

Descrizione del lavoro

Description

What You’ll Do:

As the Information Systems Security Officer (ISSO), you will support cybersecurity compliance, assessment and authorization, and continuous monitoring of information systems.

The ISSO will coordinate with Government cybersecurity personnel, Information System Security Managers (ISSMs), system administrators, network administrators, and engineering teams to implement security requirements, maintain authorization documentation, and address vulnerabilities.

This position requires on-site work at ASEC’s corporate office in Lexington Park, MD. Some travel to supported locations may be required.

Key Responsibilities:

• Support Risk Management Framework (RMF) activities throughout the system lifecycle, including security control implementation, assessment preparation, authorization, and continuous monitoring.
• Develop, update, and maintain cybersecurity documentation, including System Security Plans (SSPs), security control implementation statements, supporting evidence, and authorization package artifacts.
• Maintain system security records and authorization documentation in eMASS or other Government-designated repositories.
• Coordinate with technical teams to maintain accurate hardware and software inventories, system boundary descriptions, network diagrams, and configuration baselines.
• Perform and review vulnerability assessments using the Assured Compliance Assessment Solution (ACAS), applicable DISA Security Technical Implementation Guides (STIGs), and the Security Content Automation Protocol (SCAP) Compliance Checker.
• Evaluate scan results and STIG findings, coordinate remediation with system and network administrators, and validate corrective actions.
• Develop and maintain Plans of Action and Milestones (POA&Ms), track remediation progress, and prepare mitigation statements and supporting documentation for Government review.
• Monitor compliance with applicable cybersecurity policies, approved system configurations, and authorization conditions.
• Review proposed hardware, software, network, and system configuration changes for cybersecurity impacts and support established configuration management processes.
• Coordinate cybersecurity requirements for system installations, upgrades, integration activities, and deployments.
• Review security logs and monitoring information, identify potential concerns, and coordinate follow-up with appropriate technical and cybersecurity personnel.
• Report suspected cybersecurity incidents through established channels and assist with evidence collection, documentation, and corrective actions.
• Support inspections, security control assessments, and authorization reviews by organizing evidence, addressing findings, and tracking follow-up actions.
• Up to 10% travel will be expected.

What You’ll Bring:

• Bachelor’s degree in Cybersecurity, Information Technology, Computer Science, Information Systems, or a related technical field.
• At least 5 years of related IA/Cybersecurity experience is preferred.
• Demonstrated experience supporting cybersecurity compliance, vulnerability management, or assessment and authorization activities for DoD information systems.
• Working knowledge of RMF, NIST SP 800-53 security controls, and DoD cybersecurity requirements.
• Experience developing and maintaining authorization documentation, security control evidence, and POA&Ms.
• Experience using ACAS, DISA STIGs, and SCAP tools to assess system security and support vulnerability remediation.
• Familiarity with eMASS or comparable cybersecurity assessment and authorization repositories.
• Working knowledge of Windows and Linux operating systems, networking fundamentals, access controls, and system hardening.

Certification Requirements:

• At a minimum, this position requires CompTIA Security+.
• Candidates with a bachelor’s degree specifically in Cybersecurity, Data Science, Information Systems, Information Technology, or Software Engineering do not require an additional certification beyond the baseline (Security +) requirement.
• Candidates without one of these degrees must hold one of the following additional certifications: SecurityX, GMON, CCISO, CCSP, CGRC/CAP, CISSO, Cloud+, GCSA, GSEC, SSCP. Note: your CISSP or CISM will satisfy the additional certification requirement.

Not sure if your education or certifications meet these requirements? We encourage you to apply. We’re happy to review your qualifications and determine whether your experience and credentials align with the position.

Equally Important:

• Ability to build positive, collaborative relationships across teams and with external partners.
• Effective communicator with strong verbal and written skills.
• Proactive, self-directed work style with the ability to operate independently.
• Analytical thinker with proven problem-solving capabilities.
• Highly organized, with the ability to balance competing priorities in a fast-paced environment.

ASEC is committed to providing access and reasonable accommodation in its services, activities, programs, and employment opportunities in accordance with the Americans with Disabilities Act and other applicable laws.

Security Clearance Requirement:

• This position requires U.S. citizenship and an active DoD Top Secret clearance. Selected candidate will be subject to a government security investigation and must meet eligibility requirements for access to classified information.

Salary Range:

• The anticipated annual salary range for this position is $125,000 - $140,000, commensurate with an individual’s experience, qualifications, and skill set. ASEC is committed to providing fair and equitable compensation.

Who We Are:

ASEC offers meaningful, mission-driven work within a culture that supports your professional and personal growth. We partner with our government customers to deliver innovative solutions across engineering, information technology, training, and logistics. Above all, we are committed to doing what’s right for the Warfighter—plain and simple. Explore what makes ASEC different by visiting our website.

Why work at ASEC?

• 100% employee-owned company. Learn more about our Employee Stock Ownership Plan (ESOP) here!
• Comprehensive benefits package, including 11 paid holidays, medical/dental/vision coverage, HSA/FSA options, disability insurance, and more!
• 401(k) with company match
• Tuition assistance for undergraduate and graduate education
• Veteran-friendly employer
• Thriving employee culture

ASEC is an Equal Opportunity Employer. We recruit, hire, train, compensate, and promote employees based on qualifications, merit, and business needs, without regard to race, color, religion, sex, national origin, ancestry, age, marital status, sexual orientation, gender identity or expression, disability, veteran status, genetic information, pregnancy or related conditions (including breastfeeding), or any other status protected by law.

ASEC also complies with all applicable pay transparency laws and will not discriminate against employees or applicants for inquiring about, discussing, or disclosing compensation.