Information Systems Security Officer (ISSO) / RMF Analyst

Command Post Technologies, Inc; Arlington (VA); On-site; USD 110,000 - 150,000; Full time

Benefits offered by this job

Health benefits

Leadership training

401k with company matching

Employee Stock Ownership Plan (ESOP)

Tuition reimbursement

Flexible hours

Work/Life balance

Paid Time Off

Parental Leave

Job summary

Command Post Technologies, Inc. (CPT) is seeking Information Systems Security Officers (ISSOs) and RMF Analysts for anticipated DARPA opportunities in Arlington, Virginia.

The role supports governance, system authorization, security control implementation, and continuous monitoring across classified and unclassified environments. Candidates should understand DoD policies, RMF processes, and the documents needed to obtain and maintain Authorizations to Operate (ATOs).

Qualifications

• Familiarity with RMF processes and DoD cybersecurity policies.
• Ability to prepare SSPs, SARs, POA&Ms and security artifacts.
• Experience with vulnerability management and continuous monitoring.
• Strong technical writing and stakeholder communication.

Responsibilities

• Support RMF implementation across information systems.
• Develop and maintain authorization documentation (SSP, SAR, POA&Ms).
• Assist with assessment, control implementation, and continuous monitoring.
• Review vulnerability scans and compliance findings.
• Coordinate with admins, engineers, and government personnel.
• Prepare documentation for audits and assessments.
• Evaluate changes to systems for impacts to authorization.

Skills

RMF

NIST SP 800-53

DoDI 8510.01

Security policy interpretation

Clear communication

Tools

eMASS

Xacta

ACAS

STIG Viewer

SCAP

Job description

Description

Command Post Technologies, Inc. (CPT) is seeking Information Systems Security Officers (ISSOs) and Risk Management Framework (RMF) Analysts for anticipated opportunities supporting the Defense Advanced Research Projects Agency (DARPA) in Arlington, Virginia.

The selected candidate will support cybersecurity governance, information system authorization, security control implementation, and continuous monitoring activities across classified and unclassified environments. This position requires a working understanding of DoD cybersecurity policies, RMF processes, and the documentation necessary to obtain and maintain system Authorizations to Operate (ATOs).

This requisition supports anticipated task-order opportunities under an awarded contract vehicle. Employment is contingent upon task-order award, funding, and position availability.

Key Responsibilities

• Support implementation and maintenance of the DoD Risk Management Framework (RMF) across assigned information systems.
• Develop, review, and maintain cybersecurity authorization documentation, including System Security Plans (SSPs), Security Assessment Reports (SARs), Plans of Action and Milestones (POA&Ms), and related security artifacts.
• Assist with system assessment and authorization activities, including security control identification, implementation, assessment, and continuous monitoring.
• Review vulnerability scan results, configuration assessments, and compliance findings to identify and track security risks.
• Support implementation and validation of DISA Security Technical Implementation Guides (STIGs), security baselines, and applicable DoD cybersecurity directives.
• Coordinate with system administrators, engineers, security control assessors, and Government security personnel to address cybersecurity requirements.
• Maintain documentation supporting system interconnections, contingency planning, incident response, and continuous monitoring strategies.
• Track remediation activities and coordinate updates to cybersecurity compliance records.
• Support security audits, inspections, and assessments by preparing documentation and providing technical information.
• Evaluate changes to systems, configurations, and security requirements for potential impacts to authorization and compliance.

Requirements

• Final DoD Secret security clearance, with the ability to meet additional task-order security requirements.
• Minimum of 3 years of experience supporting information system security, RMF, cybersecurity compliance, or assessment and authorization activities.
• Working knowledge of NIST SP 800-53, DoDI 8510.01, and DoD RMF processes.
• Experience developing or maintaining cybersecurity authorization documentation, including SSPs, POA&Ms, and security control assessments.
• Familiarity with vulnerability management, security configuration compliance, and continuous monitoring.
• Ability to analyze cybersecurity requirements and communicate compliance findings to technical and nontechnical stakeholders.
• Strong technical writing, documentation management, and organizational skills.

Desired Qualifications

• Experience supporting classified DoD systems, Intelligence Community environments, or Special Access Programs.
• Experience using eMASS, Xacta, ACAS, STIG Viewer, SCAP, or comparable RMF and compliance tools.
• CompTIA Security+, CAP/CGRC, CISSP, CISM, or comparable security certification.
• Familiarity with JSIG, ICD 503, CNSSI 1253, and specialized security authorization processes.
• Experience supporting CCRIs, CCORIs, or other DoD cybersecurity inspections.
• Experience coordinating with Information System Security Managers (ISSMs), Authorizing Officials (AOs), and Security Control Assessors (SCAs).
• Prior experience supporting DARPA or another DoD research and development organization.

Work Location and Schedule

Anticipated work location is Arlington, VA. Specific work schedules, onsite requirements, and travel will be determined by individual task orders.

About us

We are Command Post Technologies, Inc. (CPT). CPT is a Service-Disabled, Veteran-Owned Small Business (SDVOSB), providing engineering services in the areas of Cyber Security, Software Development, Test & Evaluation, and Strategic Planning. CPT employees appreciate working in a caring environment that promotes a healthy work-life balance. As individuals, we come together as a team, supporting a culture rooted in our core principles of integrity, determination, and innovation. In all of CPT’s collaboration efforts, our team prioritizes communication, accountability, and being resourceful in order to maximize efficiency and results.

Command Post Technologies, Inc. (CPT) is a Service-Disabled Veteran-Owned Small Business (SDVOSB) founded in 2008 and headquartered in Suffolk, VA with personnel in various states including Virginia, Maryland, Florida, and Texas. With 2/3 of our staff being former military, CPT firmly believes in employing veterans. Command Post Technologies, Inc. is a unique provider of innovative solutions that enhance our corporate clients’ productivity and empower our government clients with the ability to protect against all enemies: foreign and domestic. CPT adapts its successful military experiential approach to the needs of leaders in a global business environment and provides an elite leadership curriculum that results in a world-class, leadership-altering event.

Command Post Technologies Inc. (CPT) is an Equal Employment Opportunity and Affimative Action employer. We consider applicants without regard to race, color, religion, age, national origin, ancestry, ethnicity, gender, gender identity, gender expression, sex, sexual orientation, marital status, veteran status, disability, genetic information, citizenship status, or membership in any other group protected by federal, state, or local law. We take affirmative action to ensure equal opportunities for employees and potential employees without regard to race, color, religion, age, national origin, ancestry, ethnicity, gender, gender identity, gender expression, sex, sexual orientation, marital status, veteran status, disability genetic information, citizenship status, or membership in any other group protected by federal, state, or local law.

We abide by the Pay Transparency Nondiscrimination Provision and will refrain from discharging or otherwise discriminating against employees or applicants who inquire about, discuss, or disclose their compensation or the compensation of other employees or applicants. An exception exists where the employee or applicant makes the disclosure based on information obtained while performing his or her essential job functions.

What’s In It For You

• Great health benefits (for more info contact us directly)
• Leadership training
• 401k with generous company matching
• Employee Stock Ownership Plan (ESOP)
• Career professional development
• Tuition reimbursement
• Flexible hours
• Work/Life balance
• Rewards and recognition
• Paid Time Off
• Parental Leave