ISSO II — RMF & Continuous Monitoring Lead

Draper Labs; Cambridge (MA); On-site; USD 82,000 - 220,000; Full time

Job summary

Draper in Cambridge, MA seeks an Information System Security Officer 2 (ISSO) to support continuous monitoring and authorization of classified information systems under the ISSM. The role covers technical and non-technical cybersecurity tasks, including SSP updates, configuration management, incident response, and security training.

The position requires 3–5 years of relevant experience, a bachelor's in IT or related field, IAM I/IAT II or higher, and current Top Secret clearance.

Qualifications

• Understanding of RMF (NIST SP 800-53, JSIG, DAAG, ICD 503)
• Familiar with vulnerability management processes and tools
• Knowledge of network infrastructure concepts (WAN/LAN) and security controls
• Experience with system security policies and authorization packages

Responsibilities

• Assist ISSM and assume ISSM responsibilities when needed.
• Ensure systems are operated and disposed of per security policies.
• Attend security training related to duties.
• Verify users have proper clearances and need-to-know.
• Conduct periodic reviews for compliance with security packages.
• Coordinate changes to hardware/software with ISSM and AO/DAO.
• Notify ISSM/AO/DAO of changes affecting authorization.
• Monitor recovery processes and restore security features.
• Maintain current IS security documentation.
• Conduct ConMon activities and participate in status meetings.
• Manage hardware and software configuration baselines.
• Identify architectural flaws using STIG/SCAP/Nessus tools.
• Mentor ISSO 1 personnel.
• Perform other duties as assigned.

Skills

RMF knowledge

Vulnerability management

Security tools

Networking basics

IT fundamentals

Education

Bachelor's degree in IT or related field

IAM I/IAT II certification

Tools

PS/Bash scripting

Nessus

Job description

Draper in Cambridge, MA seeks an Information System Security Officer 2 (ISSO) to support continuous monitoring and authorization of classified information systems under the ISSM. The role covers technical and non-technical cybersecurity tasks, including SSP updates, configuration management, incident response, and security training.

The position requires 3–5 years of relevant experience, a bachelor's in IT or related field, IAM I/IAT II or higher, and current Top Secret clearance.