USAF - ISSO

cFocus Software Incorporated; United States; On-site; USD 110,000 - 170,000; Full time

Job summary

cFocus Software Incorporated seeks an Information System Security Officer (ISSO) to join a USAF program. The role is on-site in Linthicum Heights, MD and requires an active TS/SCI clearance. You will perform ISSO duties, RMF activities, and prepare SSPs and evidence in eMASS.

Responsibilities include maintaining ATO/Assess-Only packages, coordinating remediation, and supporting cATO with DevSecOps. Strong writing and stakeholder collaboration are essential for success.

Qualifications

• Active TS/SCI clearance
• B.S. Computer Science, Information Technology, or a related field
• Experience performing ISSO duties and RMF package maintenance
• Experience preparing SSPs, assessment docs, control evidence, and POA&Ms in eMASS
• Knowledge of security control assessment, continuous monitoring, STIG, and vulnerability management
• Ability to evaluate findings, coordinate remediation, and maintain risk records
• Understanding of authorization boundaries, configuration control, and changes in security impact
• Ability to work with system owners, ISSMs, engineers, assessors, and Government stakeholders
• Strong technical writing, evidence management, and reporting skills

Responsibilities

• Develop, maintain, and update ATO and Assess-Only packages for assigned DC3 systems.
• Execute steady-state RMF activities, including ongoing assessments, STIG compliance, and remediation tracking.
• Prepare initial SSPs, support Security Assessment Plans, and assemble evidence for systems lacking an ATO.
• Maintain current system records in eMASS; resolve gaps with technical teams.
• Maintain POA&Ms, track actions and dependencies, and provide updates for enterprise consolidation.
• Review vulnerability results; coordinate remediation, validate closure evidence, and identify overdue findings.
• Support cATO through automated compliance evidence and monitoring data with DevSecOps and operations.
• Assess system changes for security impacts; maintain boundaries, configurations, inventories, and records.
• Track cyber orders and directives; prepare compliance docs or POA&Ms when needed.
• Provide ISSM with risk information and remediation options for risk acceptance decisions.
• Coordinate with owners, assessors, engineers, and ISSM to prepare Government review packages.
• Support incident response with security documentation and tracking corrective actions.
• Maintain security procedures and assessment records; support audits and provide status briefings.

Skills

TS/SCI clearance

Security program experience

Security writing

Education

B.S. Computer Science / IT / related field

Tools

eMASS

Job description

cFocus Software seeks a Information System Security Officer (ISSO) to join our program supporting the United States Air Force (USAF). This position is on-site in Linthicum Heights, MD. This position requires an Active TS/SCI clearance.

Qualifications:

• Active TS/SCI clearance
• B.S. Computer Science, Information Technology, or a related field
• Experience performing ISSO duties and developing or maintaining RMF authorization packages.
• Experience preparing SSPs, assessment documentation, control evidence, and POA&Ms in eMASS.
• Knowledge of security control assessment, continuous monitoring, STIG compliance, and vulnerability management.
• Ability to evaluate security findings, coordinate remediation, and maintain accurate system risk records.
• Understanding of authorization boundaries, configuration control, and security impacts of system changes.
• Ability to work with system owners, ISSMs, engineers, assessors, and Government stakeholders.
• Strong technical writing, evidence management, and communication skills for reviews and reporting

Duties:

• Develop, maintain, and update Authorization to Operate (ATO) and Assess-Only Authorization packages for assigned DC3 systems.
• Execute steady-state RMF activities for systems with valid authorizations, including ongoing security control assessments, STIG compliance, and remediation tracking.
• Prepare initial System Security Plans (SSPs), support execution of Security Assessment Plans, and assemble authorization evidence for systems lacking an ATO.
• Maintain complete, current system records in the Enterprise Mission Assurance Support Service (eMASS); resolve documentation and evidence gaps with technical teams.
• Maintain system-level Plans of Action and Milestones (POA&Ms), track corrective actions and dependencies, and provide updates for enterprise consolidation by the ISSM.
• Review vulnerability assessment and configuration compliance results; coordinate remediation, validate closure evidence, and identify overdue or unresolved findings.
• Support continuous ATO (cATO) through automated compliance evidence and monitoring data in coordination with DevSecOps and operations personnel.
• Assess assigned system changes for security and authorization impacts; maintain consistent boundaries, configurations, inventories, and supporting records.
• Track applicable cyber orders, taskers, and directives; coordinate required system changes and prepare compliance documentation or POA&Ms when immediate compliance is not achievable.
• Provide the ISSM with system risk information, remediation options, and supporting evidence for enterprise risk analysis and Government risk acceptance decisions.
• Coordinate with system owners, assessors, engineers, and the ISSM to prepare packages for Government review and address review findings before planned deployment.
• Support incident response by providing system security documentation, assessing control implications, and tracking directed corrective actions.
• Maintain security procedures and assessment records; support audits and provide status briefings, compliance evidence, and technical documentation as assigned.