Information System Security Officer (ISSO)

Omniscius; Oakton (VA); On-site; USD 110,000 - 150,000; Full time

Job summary

Omniscius in Oakton, VA is seeking an Information System Security Officer (ISSO) to ensure secure operation of complex multi-enclave IT and R&D systems. The ISSO serves as the principal advisor to system owners on security posture and supports continuous monitoring without disrupting critical research.

This hands-on governance role relies on RMF, ACAS/Tenable.sc, Nessus, and DoD tooling to maintain ATO statuses, validate compliance, and coordinate remediation with administrators and

Responsibilities

• RMF Lifecycle Management: Develop, maintain, and oversee RMF authorization packages (SSP, SAR, RAR, SAP, and POA&M) within systems of record (e.g., eMASS, Xacta).
• ACAS Operations & Vulnerability Management: Execute credentialed and non-credentialed ACAS scans; analyze results to identify vulnerabilities and validate compliance.
• POA&M & Remediation Advisory: Translate scan results into actionable mitigation and coordinate with admins and researchers to remediate.
• Continuous Monitoring (ConMon): Implement and oversee ConMon strategies; review dashboards, logs, and configurations for NIST 800-53 controls.
• Air-Gapped & Multi-Enclave Support: Facilitate secure data transfers and validation for isolated enclaves.
• Security Assessments: Conduct routine checks and support third-party assessments and ATO control validations.
• Incident Handling: Coordinate with ISSM and response teams to investigate anomalies and potential data spillages.

Skills

RMF Lifecycle Management

ACAS Operations

Vulnerability Management

ConMon

Air-Gapped Enclave Support

Security Assessments

Incident Response

Tools

eMASS

Xacta

Nessus/Tenable.sc

Splunk

Elastic

STIG Viewer

Evaluate-STIG

Job description

• Job Title: Information System Security Officer (ISSO)
• Location: On-Site in Oakton, VA
• Department: Cyber Security Services
• Reports To: Management
• FLSA Status: Full Time/Non-exempt
• Clearance: Top Secret with the ability to obtain SCI with CI Poly

Job Purpose:

The Information Systems Security Officer (ISSO) ensures the secure operation of complex, multi-enclave IT and Research & Development (R&D) systems. The ISSO serves as the principal advisor to Information System Owners regarding security posture. This role requires a "hands-on" governance approach, heavily utilizing the Assured Compliance Assessment Solution (ACAS) and standard DoD tooling to drive Continuous Monitoring (ConMon), validate compliance, and maintain active Authority to Operate (ATO) statuses without disrupting critical experimental research.

Duties & Responsibilities:

ISSO responsibilities include, but are not limited to:

RMF Lifecycle Management: Develop, maintain, and oversee RMF authorization packages (SSP, SAR, RAR, SAP, and POA&M) within systems of record (e.g., eMASS, Xacta) for standard enterprise and non-standard research environments.

ACAS Operations & Vulnerability Management: Execute credentialed and non-credentialed ACAS (Tenable.sc / Nessus) scans across connected and air-gapped networks. Analyze scan results to identify vulnerabilities, assess risk, and validate compliance against DoD baselines.

POA&M & Remediation Advisory: Translate complex ACAS scan results and DISA STIG findings into actionable mitigation strategies. Work directly with systems administrators and researchers to remediate vulnerabilities, track progress, and close POA&M items.

Continuous Monitoring (ConMon): Implement and oversee ConMon strategies. Review ACAS dashboards, audit logs (e.g., Splunk, Elastic), and system configurations to ensure ongoing compliance with NIST SP 800-53 controls.

Air-Gapped & Multi-Enclave Support: Facilitate secure data transfers, manual ACAS plugin/feed updates, and compliance validation for isolated, disconnected, and highly classified enclaves.

Security Assessments: Conduct routine compliance checks using SCC, STIG Viewer, and Evaluate-STIG. Support independent third-party assessments (e.g., CCRI) and ATO control validations.

Incident Handling: Coordinate with the Information Systems Security Manager (ISSM) and incident response teams to investigate security anomalies, audit anomalies, or classified data spillages.