Information System Security Officer (ISSO)

JFL CONSULTING, LLC; Omaha (NE); On-site; USD 120,000 - 140,000; Full time

Benefits offered by this job

Health premiums

FSA options

Life insurance

Disability coverage

401(k) plan

Generous PTO

Certification reimbursement

Professional development

Online learning access

Job summary

JFL Consulting, LLC is seeking an Information System Security Officer (ISSO) to support cybersecurity, RMF, and system authorization activities across secure government environments. This role focuses on maintaining security posture, supporting ATO and continuous monitoring, and ensuring compliance with DoD cybersecurity requirements.

Candidates should have hands‑on RMF processes, security documentation, vulnerability management, and remediation.

Qualifications

• Active TS/SCI clearance required.
• 3–8+ years in information security/cybersecurity/IT.
• Hands-on RMF, ATO, and ConMon experience.
• Experience with vulnerability management, scanning, STIG implementation, and remediation.
• Strong ability to develop and maintain security documentation and reports.

Responsibilities

• Support RMF & ATO activities with ISSMs/ISSOs.
• Maintain security posture across system lifecycles.
• Develop/maintain SSPs, POA&Ms, SCTMs.
• Coordinate remediation with ISSMs and engineers.
• Ensure compliance with NIST SP 800-53 Rev.5 and DoD requirements.

Skills

RMF processes

Vulnerability management

Security documentation

Authorization to Operate

ConMon

NIST RMF/800-53

Education

Bachelor's degree in Cybersecurity/IT/CS

Tools

eMASS

Xacta

Nessus Pro

ACAS

SCAP

EvaluateSTIG

Job description

Job Title

Information System Security Officer (ISSO)

Place of Performance

Bellevue, Nebraska (Omaha, Nebraska metropolitan area)

Mandatory Requirements

TS/SCI Clearance

Experience Level

Mid-Sr Level (3-8+ years)

On-Site, hybrid, remote

On-Site

Travel

Minimal / As Required

About JFL Consulting

With more than 20 years of securing some of the U.S. Department of Defense and the Intelligence Community’s most critical networks, JFL Consulting, LLC provides advanced network security solutions to a range of US Government and US commercial clients. Our cybersecurity operators are experts at assessing and defending mission-critical data and the networks that facilitate their operation. We are focused on delivering advanced products and industry best practices that meet each customer’s unique requirements. Visit www.jflconsulting.com

What We Offer

• Salary: $120k - $140k
• 100% employer-paid medical, dental, and vision premiums for employees and dependents
• Flexible Spending Accounts (healthcare, dependent care, and commuter)
• Life insurance, short-term disability and long-term disability
• 401(k) with immediate vesting of company contribution
• Generous PTO policy (15 vacation, 5 sick, 2 personal days, 11 holidays)
• We support your growth through certification reimbursement, dedicated professional development funding, and company-provided access to online learning platforms

Job Overview

JFL Consulting is seeking a skilled Information System Security Officer (ISSO) to support cybersecurity, Risk Management Framework (RMF), and system authorization activities across secure government environments. This position is focused on maintaining the security posture of assigned information systems throughout their lifecycle, supporting Authorization to Operate (ATO) and continuous monitoring activities, and ensuring compliance with applicable DoD cybersecurity requirements. Candidates should have hands‑on experience with RMF processes, security documentation, vulnerability management, security control implementation and validation, and remediation activities.

Key Responsibilities

Responsibilities - RMF & Authorization Support

• Work directly with the Risk Management Framework (RMF) team (e.g., Information System Security Managers (ISSM), ISSOs, Cyber Security Engineers) supporting critical networks, and future RMF/Authorization to Operate (ATO) efforts.
• Maintain the security posture of assigned information systems throughout their lifecycle.
• Support RMF activities, including system authorization and reauthorization efforts.
• Support development, maintenance, and execution of RMF packages within eMASS, Xacta, or other applicable compliance tools.
• Ensure compliance with applicable cybersecurity policies, standards, and frameworks, including NIST guidance (Special Publication (SP) 800-53 Rev. 5) and Department of Defense cybersecurity requirements.
• Support Security Control Assessments (SCAs), audits, inspections, and authorization activities.
• Coordinate security control remediation efforts with ISSMs, Network / Systems Engineers, System Administrators and support maintenance of system authorization status.

Security Documentation & Compliance

• Develop, maintain, and review system security documentation, including:
• System Security Plans (SSPs)
• Plans of Action and Milestones (POA&Ms)
• Security Control Traceability Matrices (SCTMs)
• Review security configurations, system changes, and software deployments for cybersecurity and compliance impacts.
• Track and report cybersecurity metrics, vulnerabilities, incidents, remediation activities, and overall compliance status.
• Support continuous monitoring (ConMon) activities and associated documentation.
• Maintain accurate documentation necessary to support RMF, ATO, audit, and compliance requirements.

Vulnerability Management & Security Operations

• Monitor system vulnerabilities and ensure timely mitigation, remediation, and documentation.
• Support vulnerability assessments, security scanning, Security Technical Implementation Guide (STIG) implementation, and remediation activities using tools such as Nessus Pro, Assured Compliance Assessment Solution (ACAS), Security Content Automation Protocol (SCAP), and EvaluateSTIG.
• Assist with incident response activities, investigations, and corrective actions.
• Validate security controls and system configurations to ensure continued compliance with established cybersecurity requirements.
• Identify cybersecurity risks and coordinate appropriate remediation with technical and program stakeholders.

Technical Coordination & Communication

• Coordinate with system owners, engineers, administrators, cybersecurity personnel, and other stakeholders to address security and compliance requirements.
• Communicate cybersecurity risks, vulnerabilities, compliance issues, and remediation requirements to technical (ISSM) and program leadership.
• Manage multiple systems, priorities, and authorization activities simultaneously.
• Produce clear and accurate technical documentation, reports, and cybersecurity status updates.

Requirements

Requirements - Certifications

• Required Baseline Certification: Active CompTIA Security+ CE certification is required as a minimum DoD 8140 baseline unless superseded by one or more of the advanced credentials below.
• Preferred / Qualifying Advanced Certifications: Holding any of the following satisfies the baseline requirement and is preferred to align with intermediate DoD Cyber Workforce Framework Role 722 (ISSM) or Role 612 (Security Control Assessor) responsibilities:
  • CISSP, CISM, CISA, or CGRC
  • CCSP or Cloud+
  • SecurityX (CASP+), CySA+, or PenTest+

Experience

• 3-8+ years of information security, cybersecurity, or information technology experience.
• Hands‑on experience supporting Department of Defense Risk Management Framework (RMF) processes and system authorization activities.
• Experience with vulnerability management, security scanning, STIG implementation, and remediation.
• Working knowledge of cybersecurity principles, security controls, and DoD compliance requirements.
• Experience supporting system authorization, reauthorization, and continuous monitoring activities.

Technical Skills

• Working knowledge of NIST SP 800-53, NIST Risk Management Framework (RMF), Security Technical Implementation Guides (STIGs), Continuous Monitoring (ConMon), eMASS or similar compliance tools, Security Control Assessments (SCAs), and Authorization to Operate (ATO) packages.
• Understanding of cybersecurity risk management, security control validation, and compliance requirements.
• Familiarity with vulnerability assessment and remediation processes.
• Familiarity with incident response processes and corrective actions.

Communication

• Strong written and verbal communication skills.
• Ability to develop and maintain clear technical and cybersecurity documentation.
• Ability to communicate security risks and compliance requirements to both technical and non-technical stakeholders.
• Ability to coordinate effectively across engineering, operations, cybersecurity, and program teams.

Preferred Education, Experience, & Skills

• Bachelor's degree in Cybersecurity, Information Technology, Computer Science, or a related field, or equivalent relevant experience.
• Experience supporting federal government or Department of Defense information systems.
• Experience supporting multiple RMF packages and ATO efforts.
• Experience with eMASS, Xacta, and DoD authorization processes.
• Familiarity with cloud security technologies and architectures.
• Demonstrated experience with cybersecurity risk management, RMF implementation, ATO support, vulnerability remediation, STIG compliance, audit/SCA support, incident response, security documentation, security control validation, and continuous monitoring.