Information Systems Security Officer (ISSO)

System Soft Technologies; Oakton (VA); On-site; USD 90,000 - 120,000; Full time

Job summary

System Soft Technologies is seeking an Information Systems Security Officer (ISSO) Associate to support federal cybersecurity operations, ensuring compliance with FISMA, RMF and ATO processes for mission-critical systems.

The role requires onsite training for ~2 months, with telework up to one day per week thereafter; you will coordinate with ISSO/ISSM teams, develop security artifacts, and help manage POAMs and incident response.

Qualifications

• Experience implementing RMF/ATO processes for federal systems.

Responsibilities

• Oversee RMF A&A activities and ATO efforts.

Skills

RMF/A&A

Vulnerability management

NIST SP 800-53

ACAS/Nessus

eMASS/Xacta

Splunk

Incident response

Policy development

DoD Top Secret Clearance

Tools

eMASS

Xacta

ACAS

Nessus

Security Center

Splunk

Job description

Client is a growing federal government contracting company seeking an Information Systems Security Officer (ISSO) Associate to support federal cybersecurity operations by ensuring compliance with federal security requirements, leading Risk Management Framework (RMF) and Authorization to Operate (ATO) activities, managing vulnerabilities, and maintaining the security posture of mission-critical information systems.

Responsibilities:

• Provide oversight for the assigned network(s) by working with operation staff to ensure compliance per STIGs and IAVM.
• This role requires being onsite five days a week during the initial training period of approximately two months. Telework may then be authorized up to one day per week.
• Ensuring that Stakeholders adhere to Federal Information Assurance policies and procedures to acquire and maintain an Information System's Authority to Operate (ATO) under The Federal Information Security Management Act (FISMA) of 2002.
• Lead RMF A&A efforts including but not limited to: activities within the A&A cycle and ISSO functions, work directly with ISSM, ISO, SCA, and AO, work with engineering and operations support staff to secure systems and ensure compliance, and provide oversight for existing and new POAMs.
• Provide POA&M support by advising CISO/AO of changes and assisting in the coordination of efforts to remediate deficiencies and vulnerabilities.
• Performing ConMon reviews for daily, weekly, monthly, and quarterly checks. (Primarily completed through Splunk. Small number of manual/administrative checks).
• Assist with Incident Response (IR) activities by verifying sanitation procedures are followed prior to submitting the CART Case to the CISO for closure.
• Work with the Security Tools Team to identify Critical / High vulnerabilities for remediation and report network security posture at weekly CISO/AO meetings.
• Create, maintain, and enforce overarching policy documents to ensure continuity and compliance within the organization.
• Other duties as assigned.

Qualifications:

• Can be substituted for Associate's degree with 2+ years relevant experience OR 4+ years relevant experience
• DoD Top Secret Clearance is required

Knowledge, Skills and Abilities:

• Experience with NIST SP 800-37, 800-137, 800-53 rev 4/5, 800-39, 800-171 and 800-171A for self-assessments; NIST 800-100, NIST 800-18.
• Familiar with creating Assessment and Authorization (A&A) packages in eMASS and/or Xacta and applying security categorization per the NIST FIPS 199 and NIST SP 800-60.
• Experience in performing and assessing Security and Privacy Controls per NIST 800-53 rev 4/5 and NIST 800-53a guidelines.
• Experience with systems engineering design and development toward a "baked-in" security design using Information Assurance best practices.
• Understanding of vulnerability and scanning tools such as Assured Compliance Assessment Solution (ACAS) and well-versed in interpreting risk posture resulting from assessment reports.
• Knowledge of vulnerability management, risk management, and project management, proficient with Microsoft products - Word, Excel, PowerPoint.
• Experience with Tenable's Nessus and/or Security Center, or Network Mapper is a plus.
• Risk assessment experience, especially with NIST SP 800-53 Threat identification, system security categorization, gap analysis, and compliance reporting.
• Must be able to validate security patches as they align with NIST guidelines, client policies and procedures, and OMB Mandates.
• Experience with creating or maintaining security artifacts as part of the ATO package including but not limited to; System Security Plans (SSP), Contingency Plans (CP), Disaster Recovery Plans (DRP), Plans of Action, and Milestone (POA&M), Incident Response (IR), and other security documentation.