OverviewWe are seeking an Information System Security Officer (ISSO) to support a Network Operations Center Network Management Support Services. The ISSO will serve as a designated security professional for one or more FISMA systems of record and new information systems, supporting the Assessment and Authorization (A&A) lifecycle, Authority to Operate (ATO) activities, ongoing authorization, continuous monitoring, vulnerability management, and compliance with government security requirements. This role will work closely with the Government Program Manager, Technical POC/Task Manager, Information Systems Security Manager (ISSM), COR, system owners, engineers, and security stakeholders.
Responsibilities
- Perform ISSO duties in accordance with DHS 4300A, HB 1400-05D, FISMA guidance, applicable NIST publications, and approved program SOPs.
- Lead or support the Assessment and Authorization (A&A), reaccreditation, and continuous-monitoring processes for assigned information systems.
- Notify security leadership of upcoming accreditation or reaccreditation requirements and coordinate reaccreditation kickoff activities with the agency's Security Authorization Team.
- Support the transition of designated systems to Ongoing Authorization (OA), also known as continuous monitoring.
- Manage Plans of Action and Milestones (POA&Ms), including development, documentation, SME follow-up, remediation tracking, and status reporting.
- Review Information Security Vulnerability Management (ISVM) messages, determine applicability, acknowledge notifications, track remediation, and coordinate POA&M creation for unresolved vulnerabilities.
- Review weekly network scans and log information; prepare vulnerability summaries and identify critical and high-risk issues affecting assigned systems.
- Maintain accurate system asset inventories and provide updates to the Vulnerability Assessment Team (VAT); reconcile system inventories with DHS detailed asset reports.
- Review proposed change requests to verify that changes comply with security standards and update asset records and System Security Plans (SSPs) when systems or configurations change.
- Develop, review, maintain, and submit A&A and security documentation for Government approval, including SSPs, risk assessments, FIPS 199 categorization assessments, ST&E plans and results, ATO and ATT artifacts, contingency plans, ISAs, waivers, and POA&Ms.
- Review and update SSPs annually or when significant system changes occur; complete annual NIST SP 800-26 or NIST SP 800-53 assessments as required.
- Prepare documentation and support the annual Ongoing Authorization Review Management Board (OARMB), DHS/CISA/OMB audits, cybersecurity data calls, and FedRAMP or cloud-as-a-service activities, as applicable.
- Assist the Computer Security Incident Response Center (CSIRC) with investigations of security violations and incidents.
- Support encryption and security compliance requirements, including FIPS 197 AES-256, FIPS 140-2 validated cryptographic modules, NSA Type 1 or
- Type 2 encryption, PKI, and emerging FIPS 203, 204, and 205 requirements.
- Prepare weekly ISSO reports covering ATO activities, assessments, audits, change requests, POA&Ms, ISVMs, waivers, compliance highlights, and issues requiring management guidance.
Qualifications
- Senior ISSO candidates should demonstrate approximately 5–10 years of relevant information systems security, cybersecurity, or security authorization experience. Candidates supporting junior-level ISSO assignments.
- In-depth knowledge of the Risk Management Framework (RMF), NIST publications, FISMA, DHS 4300A, and HB 1400-05D.
- Assessment and Authorization: Demonstrated experience implementing or assessing NIST SP 800-53 controls and supporting A&A, ATO, reaccreditation, or continuous-monitoring activities.
- Experience reviewing Nessus or comparable vulnerability scans, tracking ISVMs, managing remediation, and developing or maintaining POA&Ms in an enterprise environment.
- Experience preparing or maintaining SSPs, security assessments, risk assessments, contingency plans, ST&E artifacts, ATO packages, waivers, and related security documentation.
- Understanding of enterprise networking concepts, infrastructure, architectures, and configuration changes.
- Ability to work effectively in a team environment, build rapport with Government and customer organizations, and communicate technical security issues clearly.
- Education: Bachelor’s degree in cybersecurity, information assurance, computer science, information systems, or a related field is preferred; equivalent relevant experience may be considered.
Preferred Qualifications
- Experience supporting a federal or other mission-critical enterprise network operations environment.
Security Clearance
- Ability to obtain Public Trust, Preferred Secret/Top Secret Clearance
Certifications
- CISSP, Security+, Network+, CISA, CAP, or security auditing certification recommended.
Pay Transparency StatementAMERICAN SYSTEMS is committed to pay transparency for our applicants and employee-owners. The salary range for this position is USD $110,800.00/Yr. - USD $185,100.00/Yr. Actual compensation will be determined based on several factors permitted by law. AMERICAN SYSTEMS provides for the welfare of its employees and their dependents through a comprehensive benefits program by offering healthcare benefits, paid leave, retirement plans, insurance programs, and education and training assistance.
