Information Systems Security Officer

ERT, Inc.; West Laurel (MD); In loco; USD 110.000 - 140.000; Tempo pieno

Descrizione del lavoro

Sev1Tech is seeking an experienced Information Systems Security Officer (ISSO) to manage RMF accreditation packages and ensure IATT/ATO for the NAVSUP OIS program. The role includes maintaining cyber security in AWS GovCloud and applying DoD policies across applications and infrastructure.

The ISSO will lead STRM development, perform IA control assessments, and coordinate with DISA, IA staff, and Fleet Cyber Command to implement PPSM/ACL changes.

Competenze

• Must have DOD Secret clearance to start (T3 background check).
• Certification: Directive 8570.1/8140 IAM-1 Security+.
• Bachelor’s degree with minimum 6 years of relevant experience.
• Experience with risk assessments and audits.
• Experience using DoD approved tools (ACAS, SCAP scanners, eMASS).
• Knowledge of RMF and NIST compliance for security professionals.
• Experience presenting to clients/management to convey technical information.
• Experience guiding stakeholders through the ATO process.
• Familiarity with AWS GovCloud (DoD preferred).
• Ability to create/update Security Plans and Contingency Plans.

Mansioni

• Prepare, submit, and monitor RMF accreditation packages to obtain IATT or ATO.
• Develop STRM aligning security requirements with system components.
• Monitor security posture and document findings in quick-look reports and POA&Ms.
• Support risk assessment documentation and mitigation recommendations.
• Ensure OIS systems are scanned, patched, and compliant with DoD policy.
• Coordinate with OIS team, DISA, IA staff, and Fleet Cyber Command on PPSM/ACL changes.
• Support DITPR-DON for annual reviews.
• Provide security briefs to stakeholders and management.
• Assist DevSecOps in implementing cybersecurity requirements to meet timelines.
• Interpret scans to resolve security findings with DevSecOps and external teams.

Conoscenze

RMF knowledge

NIST compliance

Threat assessment

Formazione

Bachelor's degree

Security+ certification

CISSP (desired)

Strumenti

ACAS

SCAP-compliant scanners

eMASS

STIG Viewer

VRAM

AWS GovCloud

DADMS

PPSM

ACLs management

Descrizione del lavoro

Information Systems Security Officer

Sev1Tech is looking for an experienced Information Systems Security Officer (ISSO) who can prepare, submit, and monitor accreditation packages through the Risk Management Framework (RMF) process ensuring receipt of Interim Authority to Test (IATT) or Authority to Operate (ATO) in support of the Naval Supply Systems Command (NAVSUP) Ordnance Information System (OIS) program. The ISSO will maintain current operating cybersecurity environment within AWS GovCloud operating environment.

The ISSO will apply their knowledge of DOD Cybersecurity processes and best practices used to secure technical solutions, including applications, systems, architectures, and infrastructures.

This critical role will also be responsible for:

• Meeting and maintaining DOD RMF CYBER certification and accreditation requirements, including researching, testing and providing technical information for obtaining required system accreditation.
• Developing Security Requirements Traceability Matrix (STRM), aligning security requirements with the individual components of a system.
• Performing checks of systems and applications for Information Assurance vulnerabilities using approved automated IA tools (ACAS, VRAM, SCAP-compliant scanners, DISA STIG Viewer, etc.), custom scripts and manual processes (i.e., Security Technical Implementation Guides [STIGS]).
• Monitoring OIS security posture, documenting raw findings in a quick look report, for customer notification. Create and maintain system Plan of Action and Milestones (POA&Ms) of open vulnerabilities and applied mitigations utilizing Department of Defense Enterprise Mission Assurance Support Service (eMASS) tool.
• Supporting the development and documentation of risk assessment results and recommendations using identified threats, applicable vulnerabilities, and likelihood of occurrence within context of risk tolerances
• Monitor all database and application software used in OIS for version change control and nearing/exceeding last date allowed in the Department of Navy Application Database Management System (DADMS).
• Coordinating/interfacing with OIS Technical Team, Defense Information Systems Agency (DISA), IA Staff, and Fleet Cyber Command to document, review, revise, and submit changes related to Ports, Protocols, and Services Management (PPSM), Access Control Lists (ACLs), and Whitelists. This support includes preparing and submitting the registration forms for new requirements.
• Supporting DOD IT Portfolio Repository-DON (DITPR-DON) to support the annual review.
• Providing recommendations for corrective actions and mitigation strategies.
• Producing security risk assessment briefs and reports for delivery to stakeholders and senior management.
• Support the DevSecOps team in implementing Cyber Security requirements to achieve and maintain accreditation and authority to operate within specified timelines.
• Interpret OS, web server, and database scans to facilitate resolving security findings with the DevSecOps team and external teams
• Conducting security monitoring through the use of VRAM (Vulnerability Remediation Asset Manager), and applying mitigation techniques to reduce and remediate vulnerabilities
• Coordinating / troubleshooting with afloat platforms to assist in identification and remediation of cybersecurity vulnerabilities within the Program of Record (POR) area of responsibility
• Ensure systems are scanned, patched, and compliant with DoD policy
• Troubleshoot Windows and RHEL security policies
• Support with configurations including CloudWatch logs, registering systems, reporting and manage findings
• Assess systems to determine applicable IA controls based on design, architecture, and data
• Attend risk management and system meetings to provide status updates and take action items
• Other duties as required

ID 2026-10011

Type Full Time W/Benefits Ret Match

Location : Location US-Secondary Location US-PA-Mechanicsburg

Security Clearance Secret

Minimum Qualifications

• Must have DOD Secret level clearance to start (T3 background investigation)
• Certification Requirement: Directive 8570.1/8140 - IAM-1: Security+
• Bachelor's degree with a minimum of 6 years of relevant experience.
• Experience performing risk assessments and audits.
• Experience using DoD approved tools (ACAS, SCAP-compliant scanners, eMASS, etc.).
• Knowledge of the overall Risk Management Framework and NIST compliance as a security professional.
• Experience presenting to clients or management to present technical and non-technical information to allow key personnel to make informed decisions.
• Experience successfully advising stakeholders through the ATO process.
• Familiarity with information security documents, government orders, notices, and guidelines.
• Experience documenting and maintaining systems running in AWS GovCloud (DoD preferred)
• Ability to work independently to create and update Security Plans, Contingency Plans, and other security documents
• Solid understanding in DoD Cyber Security policies and requirements

Desired Qualifications

• Bachelor's degree in Engineering, IT, Computer Science, or related field or equivalent
• 10 years' experience in ISSO capacity
• Experience supporting DoD (Navy preferred) enterprise application in the AWS GovCloud (up to IL 6) in a security capacity
• CISSP or equivalent certification
• AWS Certified Security certification