Senior Information Systems Security Officer (ISSO)

SAIC; United States; On-site; USD 125,000 - 180,000; Full time

Benefits offered by this job

On-site in Springfield, VA

Competitive salary

Job summary

SAIC seeks a Senior Information Systems Security Officer (ISSO) to manage RMF compliance, evaluate security controls, and support ATO for mission-critical IT systems on the MAJESTIC JPO Team. On-site work in Springfield, VA with cross-functional collaboration.

The ideal candidate has 2–5 years of enterprise IT security experience, strong writing and risk assessment skills, and holds TS/SCI clearance with relevant certifications (CISSP/CISM/CISA or equivalent).

Qualifications

• Bachelor's degree in Cybersecurity or related field.
• 2–5 years of professional experience in enterprise IT environments.
• Active TS/SCI clearance with ability to obtain/maintain.
• Experience with RMF/NIST 800-53 and ATO processes.
• Familiarity with vulnerability scanners and SIEM tooling.
• Strong analytical, writing, and communication skills.

Responsibilities

• Develop and maintain RMF artifacts (SSPs, POA&Ms) and applicable policies.
• Implement and validate security controls per NIST 800-53 and overlays.
• Support ATO processes to obtain and maintain Authority to Operate.
• Conduct risk assessments and identify remediation steps.
• Harden systems per DISA STIGs and CIS Benchmarks.
• Monitor systems using SIEM tools and coordinate incident response.
• Collaborate with system owners, admins, and ISSMs to address risks.
• Provide cybersecurity awareness and leadership briefings.
• Create and maintain security documentation and SOPs.

Skills

RMF & NIST 800-53

SSP & POA&M

Vulnerability assessment

SIEM monitoring (Splunk/ACAS/Qualys)

Windows Server security

Networking security basics

Technical writing

Education

Bachelor’s Degree in Cybersecurity/Related field

Certifications: CISSP / CISM / CISA

Tools

Nessus

ACAS

Qualys

Splunk

SolarWinds

Job description

SAIC is seeking a motivated and skilled Senior Information Systems Security Officer (ISSO) to support cybersecurity and compliance activities for mission-critical IT systems on the MAJESTIC Joint Program Office (JPO) Team . In this role, the ISSO will be responsible for implementing, managing, and assessing system security controls to ensure compliance with government regulations, standards, and best practices, including NIST 800-53 , RMF , and other federal security policies.

The ideal candidate will work closely with system owners, administrators, and cross-functional security teams to assess risks, maintain security postures, and ensure the confidentiality, integrity, and availability of information systems that support the mission. This role requires on-site support in Springfield, VA .

Key Responsibilities:

• Ensure compliance with Risk Management Framework (RMF) requirements by developing, maintaining, and assessing system security artifacts, including System Security Plans (SSPs), POA&Ms, and applicable policies and procedures.
• Implement and validate security controls in alignment with NIST 800-53, associated overlays, and system-specific requirements.
• Support the Accreditation and Authorization (A&A) process, including preparing documentation and achieving and maintaining system Authority to Operate (ATO) status.
• Conduct risk assessments and vulnerability analysis, identify potential threats and weaknesses, and provide recommendations for mitigation.
• Work with IT teams to implement system hardening for platforms, applications, and networks in compliance with DISA STIGs and cybersecurity best practices.
• Perform continuous monitoring of systems using tools such as Splunk, ACAS, or SolarWinds, ensuring real-time threat detection, event notifications, and security compliance validation.
• Collaborate with cross-functional teams, including system administrators, developers, and ISSMs, to address security risks, system vulnerabilities, and security incidents.
• Support incident response activities by conducting forensic analysis, generating reports, and coordinating efforts to remediate and recover from security events.
• Provide cybersecurity awareness training for users and team members to ensure adherence to organizational security requirements and best practices.
• Prepare and deliver security status updates, risk reports, and briefings to senior stakeholders and leadership.
• Develop and maintain system documentation, including security control implementation descriptions, policies, and SOPs.

Required Qualifications:

Education:

• Bachelor’s Degree

Certifications (CWF Requirements):

• Candidates must satisfy 722 (Information Systems Security Manager) requirements, as outlined by Navy COOL (https://www.cool.osd.mil/usn/cswf/index.html?CWFModel).

This requirement can be met by possessing one or more of the following qualifying certifications:

• ISC2 CC (Certified in Cybersecurity)
• CompTIA Cloud+
• CompTIA Security+
• CompTIA SecurityX / CASP+
• ISC2 SSCP (Systems Security Certified Practitioner)
• GIAC GSEC (Security Essentials)
• United America Technologies CISSO (Certified Information Systems Security Officer)
• ISC2 CGRC / CAP (Certified in Governance, Risk, and Compliance)
• EC‑Council CCISO (Certified Chief Information Security Officer)
• ISC2 CCSP (Certified Cloud Security Professional)
• GIAC GCSA (Cloud Security Automation)
• GIAC GMON (Continuous Monitoring)
• ISACA CISM (Certified Information Security Manager)
• ISC2 CISSP (Certified Information Systems Security Professional)
• ISC2 CISSP‑ISSMP (Information Systems Security Management Professional)
• Federal IT Security Institute FITSP‑M (Federal IT Security Professional – Manager)
• GIAC GCIA (Certified Intrusion Analyst)
• GIAC GCIH (Certified Incident Handler)
• GIAC GICSP (Global Industrial Cyber Security Professional)
• GIAC GSLC (Security Leadership)

OR This requirement can be met through:

• A Bachelor’s Degree in Cybersecurity, Computer Science, IT, or a related field.

Experience:

• 2-5 years of professional experience managing and supporting enterprise-level IT environments.

Technical Skills:

• Deep understanding of security frameworks, including NIST 800-53, RMF, and/or DoD 8510.01.
• Experience developing and maintaining System Security Plans (SSPs) and managing POA&Ms for compliance and audit purposes.
• Proficiency with vulnerability scanning tools and security analysis platforms, such as Nessus, ACAS, or Qualys.
• Knowledge of security controls implementation and system hardening using DISA STIGs or CIS Benchmarks for platforms and network-enabled devices.
• Familiarity with monitoring tools such as Splunk, SolarWinds, or other SIEM solutions for proactive security monitoring and incident management.
• Strong understanding of Windows Server and Active Directory security, including account policy configurations and group policy enforcement.
• Basic knowledge of Red Hat Enterprise Linux (RHEL) for security configurations and patching.
• General understanding of networking concepts, security configurations, and protocols (e.g., TCP/IP, VLANs, IPsec, firewalls).
• Ability to conduct risk assessments, analyze vulnerabilities, and make actionable recommendations to remediate threats.
• Strong analytical and technical writing skills for maintaining security documentation, incident reports, and audit artifacts.

Preferred Certifications (In Addition to CWF Requirements):

• Certified Information Systems Security Professional (CISSP) or equivalent advanced certifications.
• Knowledge of continuous monitoring tools and automated compliance tracking systems.
• Familiarity with encryption standards, PKI infrastructures, and secure key management practices.
• Hands-on experience with virtualized environments and hyper-converged platforms, such as VMware or Nutanix.
• Familiarity with ITIL v4 frameworks for managing IT operations and processes.

Clearance Requirement:

• Active TS/SCI clearance with the ability to obtain and maintain a TS/SCI with Poly .
• Candidate must be a US Citizen

Work Environment and Notes:

• On-Site Work: All work must be conducted on-site in Springfield, VA.
• Program Scope: Supports on-premises enterprise IT environments, including virtualized Windows servers, MS SQL Server databases, and networking layers.
• Subcontractor Role: Responsibilities and compensation vary based on the subcontract agreement, with a competitive salary aligned to market rates and role-specific requirements.