Information System Security Officer (ISSO) / RMF Analyst

CACI International Inc; United States; Remote; USD 100,000 - 150,000; Full time

Job summary

CACI International Inc. is seeking a cybersecurity professional to maintain RMF authorization postures for US federal or defense information systems. The role involves RMF documentation, authorization package coordination, continuous monitoring, and remediation tracking with stakeholders across security, engineering, and operations.

The candidate will create SSPs, coordinate ATO submissions using eMASS, and manage POA&Ms through remediation. Strong knowledge of NIST SP 800-53 Rev.

Qualifications

• 3–5 years supporting RMF, ATO, or cybersecurity compliance in a DoD or federal setting.
• Active Secret or Top Secret clearance required.
• Hands-on experience with eMASS and SSP development.
• Strong knowledge of NIST SP 800-53 Rev.5 and DoD RMF.
• Experience managing POA&Ms through remediation and closure.
• Ability to collaborate with security, engineering, operations, and system stakeholders.

Responsibilities

• Create and maintain System Security Plans (SSPs) for assigned systems.
• Coordinate Authorization to Operate (ATO) submissions and keep authorization records current using eMASS.
• Track Plans of Action and Milestones (POA&Ms) from discovery through remediation and closure.
• Carry out continuous monitoring and assess whether security controls are implemented and effective.
• Prepare Security Assessment Plans and coordinate Security Assessment Report activities.
• Track authorization status and compliance measures, and contribute to supply chain risk documentation and RMF governance planning.

Skills

Analytical skills

Communication skills

Organizational skills

Education

Bachelor’s degree

Tools

eMASS

Job description

Role overview

Maintain the cybersecurity authorization posture of assigned information systems in federal or defense environments. The role combines Risk Management Framework (RMF) documentation, authorization package coordination, continuous monitoring, and remediation tracking, working with security, engineering, operations, and system stakeholders.

Responsibilities

• Create and maintain System Security Plans (SSPs) for assigned systems.
• Coordinate Authorization to Operate (ATO) submissions and keep authorization records current using eMASS.
• Track Plans of Action and Milestones (POA&Ms) from discovery through remediation and closure.
• Carry out continuous monitoring and assess whether security controls are implemented and effective.
• Prepare Security Assessment Plans and coordinate Security Assessment Report activities.
• Track authorization status and compliance measures, and contribute to supply chain risk documentation and RMF governance planning.

Requirements

• Active Secret or Top Secret clearance and compliance with DoD 8140 interim education requirements.
• 3–5 years supporting RMF, ATO, or cybersecurity compliance in a DoD or federal setting.
• Hands‑on experience with eMASS and independent development of SSPs.
• Working knowledge of NIST SP 800-53 Rev. 5, DoD RMF, and continuous monitoring.
• Demonstrated ability to manage POA&Ms through remediation and closure.
• Strong analytical, organizational, and communication skills for working with technical and non-technical partners.

Nice to have

• Experience with RMF automation tools, cloud or hybrid authorization boundaries, or large enterprise security programs.
• Familiarity with DoD RMF guidance, supply chain risk management, and cross-functional cybersecurity work.
• A relevant bachelor’s degree, a DoD 8140 basic-tier credential, or an intermediate-tier certification such as Security+, Cloud+, GCIH, or GSEC.