Mid Level Information System Security Officer (ISSO) (eMASS Specialist)

Amentum Holdings, Inc.

Virginia Beach (VA)

On-site

USD 120,000 - 180,000

Full time

6 days ago

Be an early applicant

A complete application in a minute

Tailored resume and cover letter, ready to send.

Get past ATS filters

Job summary

Amentum is seeking an Information System Security Officer (ISSO) to join our team at Fort Meade, MD. You will lead RMF efforts, manage security packages, and coordinate with assessors, maintaining robust security baselines for classified systems.

You will work on day-to-day security posture, incident response, and continuous monitoring, ensuring compliance with IC policy, NIST standards, and authorization processes across integrated teams.

Qualifications

Hands-on experience managing system records, controls, artifacts, and POA&Ms in eMASS.
Experience supporting classified networks, cross-domain solutions, or multi-enclave environments.
Familiarity with IC tools and processes for reciprocity and enterprise authorization.
Experience briefing AOs, program managers, and senior leadership.
Strong understanding of security control families and how to interpret implementation, inheritance, and assessment procedures.
Ability to translate technical findings into clear risk statements.
Excellent written communication with attention to detail in documentation.
Ability to manage multiple packages and deadlines.
Sound judgment handling classified and sensitive information.
Working knowledge of RMF, NIST SP 800-37/800-53/800-53A, CNSSI 1253, ICD 503.
Thorough knowledge of IC and national security information system policy.

Responsibilities

Support RMF steps (categorize, select, implement, assess, authorize, monitor) for assigned systems.
Maintain accurate system records in the governance, risk, and compliance tool (eMASS).
Develop and maintain authorization packages (SSP, control statements, POA&M, contingency and configuration plans).
Coordinate with assessors and officials through initial authorization, reauthorization, and continuous monitoring.
Review vulnerability scans, audit logs, and baselines; coordinate remediation and POA&M closure.
Verify patching and antivirus/endpoint protection meet timelines and baselines.
Prepare for inspections, audits, and assessments by IG, security office, and oversight bodies.
Ensure changes undergo security impact analysis and CCR review before implementation.
Detect and report security incidents; support containment after data spillage.
Assist insider threat and audit data requests; verify clearance and access need-to-know.
Oversee privileged accounts and enforce least privilege; brief users on security responsibilities.
Enforce media handling and destruction procedures; support cross-domain data transfer.
Verify systems installed in accredited spaces per ICD 705 and facility accreditation.
Advise on security requirements during design, acquisition, and development; participate in security reviews.
Maintain current IC/DoD policy knowledge; collaborate in working groups; manage multiple systems and deadlines.

Skills

eMASS POA&M management

ATO packages

Cross-domain solutions

ACAS

STIG Viewer

RMF

NIST SP 800-37/53

IC policy familiarity

Security risk translation

Technical documentation

Independent work

Education

Bachelor's degree in cybersecurity/IS/CS

Tools

C2S/cloud security tools

Job description

Purpose and Impact:

Are you interested in using your skills to help shape the Cyber, Security, & Intel space? If so, look no further. Amentum is seeking an Information System Security Officer (ISSO)to join our team of passionate individuals at Fort Meade, MD. In this role you will support challenging, mission-critical projects that make a direct impact on the Nation’s security and intelligence mission.

In support of DISA, Amentum’s Intel and Cyber Division is expanding a proven team of highly skilled engineers and architects to support a program that provides critical IT capabilities to the Department of Defense. This team is committed to engineering, assembling, integrating, deploying, and sustaining an innovative IT enterprise solution.

Our team delivers secure, mission-critical capabilities where system integrity and rapid deployment are paramount. We are seeking an Information System Security Officer (ISSO)who combines meticulous technical discipline with strategic foresight. In this role, you will lead efforts to establish and maintain robust baselines in a rapidly evolving operational environment. Success requires the ability to navigate complex, unique technical challenges independently while fostering collaborative solutions across integrated teams. To excel, you must possess a proactive learning mindset and the agility to rapidly master and govern the integration of next-generation systems and services.

Work Schedule:

8 Hours per day, Monday thru Friday

Essential Responsibilities:

The duties and responsibilities of the Information System Security Officer (ISSO)include but are not limited to the following:

The ISSO is responsible for the day-to-day security posture of assigned information systems that process, store, or transmit classified and sensitive intelligence information. The incumbent ensures systems are operated, maintained, and disposed of in compliance with Intelligence Community (IC) policy, the Risk Management Framework (RMF), and the system's authorization to operate (ATO). The ISSO is the primary on-site security point of contact for system owners, administrators, users, and the ISSM.

Key Responsibilities:

Support all RMF steps (categorize, select, implement, assess, authorize, monitor) for assigned systems in accordance with ICD 503, NIST SP 800-37 and 800-53, and CNSSI 1253.

Maintain accurate system records in the designated governance, risk, and compliance tool (e.g., eMASS or agency equivalent)
Develop and maintain authorization packages, including the System Security Plan, security control implementation statements, Plan of Action and Milestones (POA&M), contingency plans, and configuration management plans.

Coordinate with assessors and authorizing officials, and track the system through initial authorization, reauthorization, and continuous monitoring.

Review vulnerability scan results, audit logs, and security configuration baselines (e.g., STIGs); coordinate remediation and track POA&M items to closure.

Verify that patching, antivirus/endpoint protection, and configuration changes meet required timelines and baselines.

Conduct periodic self-inspections and prepare for inspections, audits, and assessments by the agency inspector general, security office, and external oversight bodies.

Ensure system changes undergo security impact analysis and configuration control board review before implementation.

Detect, document, and report security incidents, spillages, and policy violations to the ISSM and the appropriate incident response and counterintelligence elements within required timeframes.

Support containment, sanitization, and recovery actions following classified data spillage or suspected compromise.

Assist insider threat and counterintelligence personnel with user activity monitoring and audit data requests, as authorized.

Verify that users hold the appropriate clearance, formal access approvals, need-to-know, and signed user agreements before access is granted.

Oversee privileged user accounts and enforce separation of duties and least privilege.

Brief users on their security responsibilities and deliver annual and initial security awareness training.

Enforce procedures for the control, marking, transfer, sanitization, and destruction of classified media and removable storage.
Support cross-domain solution and data transfer processes in coordination with the responsible approval authority.

Verify that systems are installed and operated in accredited spaces consistent with ICD 705 and the facility's accreditation.

Advise system owners, program managers, and engineers on security requirements during design, acquisition, and development, including supply chain risk considerations.

Participate in working groups, configuration control boards, and security reviews.

Maintain current knowledge of IC and DoD policy, emerging threats, and technology changes affecting assigned systems.

Work Environment, Physical Demands, and Mental Demands:

Employee will work in a SCIF on a daily basis.

Employee may also be required to work in a datacenter environment for specified periods of time.

Minimum Requirements (Knowledge, Skills, and Abilities):

Hands-on experience managing system records, controls, artifacts, and POA&Ms in eMASS.
Experience supporting classified networks, cross-domain solutions, or multi-enclave environments.

Familiarity with ACAS, STIG Viewer, SCAP, and Assured Compliance tools.

Experience supporting ATO packages for cloud environments (e.g., C2S/commercial cloud for classified workloads).

Familiarity with IC-specific tools and processes for reciprocity and enterprise authorization.

Experience briefing AOs, program managers, and senior leadership.

Strong understanding of security control families and how to interpret implementation, inheritance, and assessment procedures.

Ability to translate technical findings into clear risk statements.

Excellent written communication, with a strong attention to detail in documentation.

Ability to manage multiple packages and competing deadlines.

Sound judgment when handling classified and sensitive information.

Ability to work independently and within cross-functional teams.
Working knowledge of the RMF, NIST SP 800-37, 800-53, and 800-53A, CNSSI 1253, and ICD 503.
Thorough knowledge of IC and national security information system policy, including CNSS issuances and agency directives.
Skill in assessing risk and applying technical, operational, and management controls.
Ability to translate policy into practical implementation guidance for system administrators.
Ability to work independently, manage multiple systems and deadlines, and exercise sound judgment in handling classified information.

Security Clearance Required: