Information System Security Officer (ISSO)

Omniscius Consulting; Oakton (VA); On-site; USD 120,000 - 180,000; Full time

Job summary

Omniscius Consulting in Oakton, VA seeks an Information System Security Officer (ISSO) to guide secure operation of multi-enclave IT and R&D systems and to maintain active ATOs using ACAS and DoD tooling. You will manage RMF packages, run ACAS scans (Tenable.sc/Nessus), analyze results, and translate findings into remediation plans with system admins and researchers.

A DoD RMF expert with 8570 IAM Level II/III, experience with eMASS or Xacta, SCC/STIG tools, and excellent written/verbal

Qualifications

• Bachelor’s degree in Cybersecurity, Information Technology, or related field.
• DoD RMF/8570 IAM Level II/III compliant.
• Expert understanding of RMF, NIST 800-53/800-37/800-171 and DISA STIGs.
• Experience managing ATO artifacts in eMASS or Xacta.
• Strong written and verbal communication to liaise with system owners and researchers.

Responsibilities

• RMF lifecycle management for SSP, SAR, RAR, SAP, and POA&M.
• ACAS scans using Tenable.sc/Nessus; analyze results and validate compliance.
• Translate scan results into actionable remediation plans with admins and researchers.
• Oversee Continuous Monitoring and review logs (Splunk/Elastic) for NIST 800-53 controls.
• Support air-gapped, multi-enclave environments and ATO validations.
• Coordinate security assessments and incident handling with ISSM.

Skills

RMF lifecycle

ACAS operations

Vulnerability mgmt

ConMon monitoring

Incident handling

Security liaison

Education

Bachelor’s degree in Cybersecurity/IT

Tools

eMASS

Xacta

Tenable.sc

Nessus

Splunk

STIG Viewer

Job description

• Job Title: Information System Security Officer (ISSO)
• Location: On-Site in Oakton, VA
• Department: Cyber Security Services
• Reports To: Management
• FLSA Status: Full Time/Non-exempt
• Clearance: Top Secret with the ability to obtain SCI with CI Poly

Job Purpose:

The Information Systems Security Officer (ISSO) ensures the secure operation of complex, multi-enclave IT and Research & Development (R&D) systems. The ISSO serves as the principal advisor to Information System Owners regarding security posture. This role requires the "hands-on" governance approach, heavily utilizing the Assured Compliance Assessment Solution (ACAS) and standard DoD tooling to drive Continuous Monitoring (ConMon), validate compliance, and maintain active Authority to Operate (ATO) statuses without disrupting critical experimental research.

Duties & Responsibilities:

ISSO responsibilities include, but are not limited to:

RMF Lifecycle Management: Develop, maintain, and oversee RMF authorization packages (SSP, SAR, RAR, SAP, and POA&M) within systems of record (e.g., eMASS, Xacta) for standard enterprise and non-standard research environments.

ACAS Operations & Vulnerability Management: Execute credentialed and non-credentialed ACAS (Tenable.sc / Nessus) scans across connected and air-gapped networks. Analyze scan results to identify vulnerabilities, assess risk, and validate compliance against DoD baselines.

POA&M & Remediation Advisory: Translate complex ACAS scan results and DISA STIG findings into actionable mitigation strategies. Work directly with systems administrators and researchers to remediate vulnerabilities, track progress, and close POA&M items.

Continuous Monitoring (ConMon): Implement and oversee ConMon strategies. Review ACAS dashboards, audit logs (e.g., Splunk, Elastic), and system configurations to ensure ongoing compliance with NIST SP 800-53 controls.

Air-Gapped & Multi-Enclave Support: Facilitate secure data transfers, manual ACAS plugin/feed updates, and compliance validation for isolated, disconnected, and highly classified enclaves.

Security Assessments: Conduct routine compliance checks using SCC, STIG Viewer, and Evaluate-STIG. Support independent third-party assessments (e.g., CCRI) and ATO control validations.

Incident Handling: Coordinate with the Information Systems Security Manager (ISSM) and incident response teams to investigate security anomalies, audit anomalies, or classified data spillages.

Requirements

Qualifications:

• Education/Experience: Bachelor’s degree in Cybersecurity, Information Technology, or related field (or equivalent experience) with 5–7+ years of experience acting as an ISSO or in a senior DoD RMF compliance role.
• DoD Directive: DoD 8570.01-M / 8140.03 compliant for IAM Level II or III (e.g., CAP, CISM, CASP+ CE, CISSP).
• Framework Knowledge: Expert-level understanding of DoD RMF (DoDI 8510.01), NIST SP 800-53/800-37/800-171, and DISA STIG implementation.
• Tooling: Proven experience managing ATO artifacts in eMASS or Xacta. Proficient with SCC, STIG Viewer, and interpreting IAVA/IAVM notices.
• Communication: Exceptional written and verbal communication skills. Ability to act as a security liaison, balancing strict DoD compliance requirements with our flexible, fast-paced R&D mission needs.