Information Systems Security Officer

acuCyber; Charleston (SC); On-site; USD 110,000 - 150,000; Full time

Job summary

acuCyber seeks an Information Systems Security Officer (ISSO) to drive the authorization and ongoing security of mission apps, cloud infrastructure, and enterprise services. The ISSO collaborates with Government security personnel, developers, and engineers to maintain security documentation and ensure compliance with DoD and IC requirements.

The role is full-time and on-site at a Government facility in Charleston, SC or the National Capital Region, requiring hands-on risk assessment, evidence

Qualifications

• Experience performing RMF activities and obtaining/maintaining ATO for systems.
• Ability to develop and maintain System Security Plans (SSPs) and supporting evidence.
• Ability to review security assessments and coordinate remediation with engineering teams.

Responsibilities

• Support RMF activities to obtain and maintain Authority to Operate (ATO).
• Develop and maintain authorization documentation including SSPs and control descriptions.
• Coordinate with system owners, ISSMs, assessors, and engineers to prepare authorization packages and resolve findings.
• Maintain POA&Ms, track remediation progress, and communicate unresolved risks.
• Use eMASS to maintain authorization records and documentation.
• Review ACAS scan results and security testing reports to prioritize remediation.
• Assess security impact of software releases and infrastructure changes.
• Support continuous monitoring with current evidence and risk reporting.
• Work with cloud and DevSecOps engineers to embed security requirements into development workflows.
• Review access controls and protection of sensitive data.
• Support security incident reporting and corrective actions.
• Apply security overlays and support supply chain risk management.
• Prepare security status reports for Government stakeholders.

Skills

RMF experience

Security controls

Risk assessment

ACAS

eMASS

DevSecOps collaboration

Tools

SSP documentation tools

Job description

acuCyber is seeking an Information Systems Security Officer (ISSO) to support the authorization and ongoing security of mission applications, cloud infrastructure, and enterprise core services. The ISSO will work with Government security personnel, software developers, and infrastructure engineers to maintain security documentation, assess risk, and ensure systems meet applicable Department of Defense and Intelligence Community requirements.

This role requires someone who can connect security requirements to how systems are built and operated. Candidates should be comfortable reviewing technical evidence, investigating compliance gaps, and working with engineers to resolve findings as software, infrastructure, and system configurations change.

This is a full-time, on-site role at a Government facility in Charleston, SC or the National Capital Region (NCR).

What You’ll Do:

• Support Risk Management Framework (RMF) activities to obtain and maintain Authority to Operate (ATO) for systems across applicable classification levels.
• Develop and maintain authorization documentation, including System Security Plans (SSPs), security control implementation statements, system boundary descriptions, and supporting evidence.
• Coordinate with system owners, Information System Security Managers (ISSMs), assessors, and engineering teams to prepare authorization packages and resolve assessment findings.
• Maintain Plans of Action and Milestones (POA&Ms), track remediation progress, and communicate unresolved risks and dependencies.
• Use the DISA Enterprise Mission Assurance Support Service (eMASS) to maintain authorization records, security control documentation, assessment evidence, and remediation status, as applicable.
• Review Assured Compliance Assessment Solution (ACAS) scan results, security configuration assessments, and application security testing reports; work with technical teams to prioritize and validate remediation.
• Assess the security impact of software releases, infrastructure changes, new integrations, and changes to the authorization boundary.
• Support continuous monitoring by maintaining current security evidence, reviewing control effectiveness, and reporting changes in system risk.
• Work with cloud and DevSecOps engineers to incorporate security requirements and evidence collection into development and deployment workflows.
• Review access controls, privileged access, audit logging, configuration baselines, and protection of sensitive data.
• Support security incident reporting, investigation, corrective actions, and updates to relevant documentation and procedures.
• Apply appropriate security overlays and support supply chain risk management activities.
• Prepare security status reports and brief Government stakeholders on authorization progress, findings, and remediation priorities.