USAF - ISSO

cFocus Software Incorporated; Linthicum (MD); On-site; USD 110,000 - 140,000; Full time

Job summary

cFocus Software Incorporated seeks an Information System Security Officer (ISSO) to support USAF programs. This on-site role in Linthicum Heights, MD requires an active TS/SCI clearance and responsibilities spanning RMF, ATO, SSPs, eMASS, and continuous monitoring.

You will work with ISSMs, system owners, engineers, assessors, and Government stakeholders to maintain security documentation, track findings, and coordinate remediation across DC3 systems. Strong writing and reporting are essential.

Qualifications

• Active TS/SCI clearance required.
• Bachelor's degree in CS/IT or related field.
• Experience performing ISSO duties and RMF authorizations.
• Experience preparing SSPs, assessment docs, POA&Ms in eMASS.
• Knowledge of security control assessment, monitoring, STIG, and vulnerability management.
• Ability to evaluate findings and coordinate remediation.
• Understanding authorization boundaries and configuration control.
• Excellent written and oral communication with stakeholders.

Responsibilities

• Develop and maintain ATO and Assess-Only packages for assigned DC3 systems.
• Execute RMF activities including control assessments and remediation tracking.
• Prepare initial SSPs and support security assessment plans.
• Maintain records in eMASS and close gaps with technical teams.
• Maintain POA&Ms and coordinate enterprise-wide remediation.
• Review vulnerability findings and coordinate remediation and evidence.
• Support continuous ATO (cATO) with automated evidence.
• Assess system changes for security impact and maintain records.
• Track cyber orders and directives; prepare comply docs or POA&Ms when needed.
• Provide security risk information and remediation options to ISSM.
• Coordinate with owners, assessors, and Government reviewers to prepare packages.
• Support incident response with documentation and tracking corrective actions.
• Maintain security procedures and assessment records; assist audits and briefings.

Skills

Active TS/SCI clearance

RMF/ATO process

eMASS experience

Vulnerability management

STIG compliance

Technical writing

Coordination with stakeholders

System risk assessment

Education

B.S. in CS/IT or related field

Tools

eMASS

Job description

cFocus Software seeks a Information System Security Officer (ISSO) to join our program supporting the United States Air Force (USAF). This position is on-site in Linthicum Heights, MD. This position requires an Active TS/SCI clearance.

Qualifications:

• Active TS/SCI clearance
• B.S. Computer Science, Information Technology, or a related field
• Experience performing ISSO duties and developing or maintaining RMF authorization packages.
• Experience preparing SSPs, assessment documentation, control evidence, and POA&Ms in eMASS.
• Knowledge of security control assessment, continuous monitoring, STIG compliance, and vulnerability management.
• Ability to evaluate security findings, coordinate remediation, and maintain accurate system risk records.
• Understanding of authorization boundaries, configuration control, and security impacts of system changes.
• Ability to work with system owners, ISSMs, engineers, assessors, and Government stakeholders.
• Strong technical writing, evidence management, and communication skills for reviews and reporting

Duties:

• Develop, maintain, and update Authorization to Operate (ATO) and Assess-Only Authorization packages for assigned DC3 systems.
• Execute steady-state RMF activities for systems with valid authorizations, including ongoing security control assessments, STIG compliance, and remediation tracking.
• Prepare initial System Security Plans (SSPs), support execution of Security Assessment Plans, and assemble authorization evidence for systems lacking an ATO.
• Maintain complete, current system records in the Enterprise Mission Assurance Support Service (eMASS); resolve documentation and evidence gaps with technical teams.
• Maintain system-level Plans of Action and Milestones (POA&Ms), track corrective actions and dependencies, and provide updates for enterprise consolidation by the ISSM.
• Review vulnerability assessment and configuration compliance results; coordinate remediation, validate closure evidence, and identify overdue or unresolved findings.
• Support continuous ATO (cATO) through automated compliance evidence and monitoring data in coordination with DevSecOps and operations personnel.
• Assess assigned system changes for security and authorization impacts; maintain consistent boundaries, configurations, inventories, and supporting records.
• Track applicable cyber orders, taskers, and directives; coordinate required system changes and prepare compliance documentation or POA&Ms when immediate compliance is not achievable.
• Provide the ISSM with system risk information, remediation options, and supporting evidence for enterprise risk analysis and Government risk acceptance decisions.
• Coordinate with system owners, assessors, engineers, and the ISSM to prepare packages for Government review and address review findings before planned deployment.
• Support incident response by providing system security documentation, assessing control implications, and tracking directed corrective actions.
• Maintain security procedures and assessment records; support audits and provide status briefings, compliance evidence, and technical documentation as assigned.