ISSO

Digital Prospectors; Lexington (MA); On-site; USD 110,000 - 150,000; Full time

Job summary

Digital Prospectors in Lexington, MA is seeking an ISSO to develop and maintain information systems security programs across Linux, Windows, Unix, Solaris, and virtualized environments.

The role supports RMF compliance, SSPs, and continuous monitoring, including vulnerability scans, incident response, and configuration management. A Secret clearance and DoD experience are required, with strong communication skills and focus on security governance.

Qualifications

• Active Secret clearance required.
• Minimum of 3 years IT security experience in a DoD environment.
• At least 5 years of experience securing Windows, Linux, Unix, Solaris, and virtualized environments.
• Experience with DISA STIGs and SRGs.
• Knowledge of RMF, NISPOM, DAAPM.
• Experience with vulnerability scanning and auditing tools.

Responsibilities

• Develop and maintain RMF-based security artifacts and SSPs.
• Secure classification boundaries across multi-OS environments.
• Monitor vulnerabilities, incidents, and configuration changes.
• Support security assessments, tests, and authorization processes.
• Ensure audit records are collected and protected.

Skills

Active Secret clearance

DoD IT security experience

5+ years securing Windows/Linux/Unix/S

RMF knowledge

DISA STIGs/SRGs experience

Vulnerability scanning

Communication skills

Security+ certification aspiration

Tools

ACAS

Nessus

Splunk

OpenRMF

McAfee ePO

Job description

The ISSO develops and maintains information systems security programs, policies, and procedures for assigned systems and environments. This role supports the security configuration and management of collateral classified and unclassified systems and networks across Linux, Unix, Solaris, Windows, and virtualized environments.

The ISSO monitors system vulnerabilities, ongoing attacks, recovery processes, security incidents, configuration changes, and user activity. This position also supports compliance with Risk Management Framework (RMF) requirements and ensures systems are operated, maintained, and disposed of in accordance with applicable security policies and System Security Plans (SSPs).

Essential Duties and Responsibilities:

• Assist the divisional ISSM and system administrators with developing and maintaining System Security Plans (SSPs) and related artifacts, including Plans of Action and Milestones (POA&Ms), Risk Assessment Reports, and Continuous Monitoring Strategies.
• Assist with security configuration and management of classified and unclassified systems and networks in traditional and virtualized environments.
• Ensure systems are operated, maintained, and disposed of in accordance with RMF security policies and procedures.
• Monitor resources for warnings regarding system vulnerabilities and ongoing attacks.
• Monitor system recovery processes to verify that security features and procedures are properly restored and functioning.
• Support security assessments, tests, reviews, and compliance assessments.
• Take appropriate action when incidents or vulnerabilities affecting classified systems or information are identified.
• Conduct network, system, and application vulnerability scanning, configuration assessments, and remediation activities.
• Apply configuration management policies and procedures governing the authorization and use of hardware and software.
• Maintain configuration management documentation, including change tracking and maintenance logs.
• Collect, analyze, store, and protect system audit records in accordance with applicable policies and procedures.
• Ensure account management documentation is complete and current.
• Develop and maintain POA&Ms identifying system weaknesses, required resources, corrective-action timelines, and mitigation activities.
• Ensure users possess the required security clearances and authorizations and understand their security responsibilities.
• Develop and update SSPs, manage system changes, and assess the security impact of proposed changes.
• Ensure user activity monitoring data is analyzed, stored, and protected in accordance with applicable policies and procedures.

Qualifications:

• Active Secret clearance required.
• Minimum of 3 years of IT security experience in a DoD environment.
• At least 5 years of relevant experience securing Windows, Linux, Unix, Solaris, and virtualized environments.
• Experience securing networks and systems using DISA STIGs and/or Security Requirements Guides (SRGs).
• Knowledge of computer security principles and policies, including RMF, STIGs, the National Industrial Security Program Operating Manual (NISPOM), and the Defense Security Service Assessment and Authorization Manual (DAAPM).
• Experience with vulnerability scanning and auditing tools and processes.
• Excellent written and verbal communication skills.
• Strong organizational and time management skills.
• Security+ certification, or the ability to obtain it within 6 months of hire.

Preferred:

• Security 8570/8141 compliance certification, or the ability to obtain it within 6 months of hire.
• Experience with ACAS, Nessus, Splunk, OpenRMF, or McAfee ePO.

POST-OFFER BACKGROUND CHECK IS REQUIRED. Digital Prospectors is an Equal Opportunity Employer and all qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, disability, veteran status, or any other characteristic protected by law. Digital Prospectors affirms the right of all individuals to equal opportunity and prohibits any form of discrimination or harassment.