Bachelor's degree in a technical discipline or equivalent experience (10 years total, 4 years as ISSO)
IAM Level 1 CWIP certification and one baseline certification (e.g., CAP, CISSP)
Experience with ICD 503/NIST 800-53 certification processes
Proficient in Risk Management Framework (RMF)
Skilled in developing and maintaining System Security Plans (SSPs)
Familiar with IAVA review and handling
Ability to interpret security scan results and communicate effectively
Responsibilities
Prepare the System Security Plan (SSP) and recommend actions for ATOs
Develop and review RMF accreditation package artifacts
Collaborate with ISSM and DAOs for system accreditation
Verify compliance of package submissions for approval
Apply continuous monitoring techniques for security posture
Create tasks for developers and system admins for updates
Oversee software patch implementation to maintain security
Benefits
Company-paid Medical/Dental/Vision plans
Short-term and long-term disability insurance, plus life insurance - company paid
Business/First Class travel upgrades for long flights
25 vacation/personal days per year
11 paid Federal Holidays
$5,000 Annual Professional Development Fund with 40 paid hours for classes
401K with 6% company match, immediately vested
$10,000 referral bonus for hiring new employees
Up to 3 paid Code Red days due to customer closure
Full Job Description
Information System Security Officer (ISSO)
The ISSO will provide guidance to the team to support system accreditation (IATT and ATO). This is a full-time position (40 hours/week, normal day shift) at a Government or contractor facility in the Fort Meade, MD area.
Job Responsibilities
Prepare the System Security Plan (SSP) and provide recommendations to assist in obtaining ATOs
Identify, develop (directly or in coordination with applicable experts), review, and incorporate common artifacts found in an RMF accreditation package, such as system architecture and boundaries, hardware and software lists, risk assessment reports, POA&Ms, data flows, and other necessary system, network, and application documentation
Work with the ISSM and DAOs to ensure systems obtain and maintain accreditation
Verify package submissions have met the threshold for approval, such as C&A packages for system reauthorization, SAR findings, CTOs, POA&Ms, and SSPs
Apply continuous monitoring techniques to evaluate the system's security posture
Create tasking for developers and system administrators as changes and patching are required
Oversee the implementation of software patches to maintain the security posture of the organization
Implement and enforce information systems security policies, standards, and methodologies
Use vulnerability scanning and assessment tools (e.g., ACAS/Nessus) to identify and document compliance
Review audit logs on a weekly basis
Perform data transfers on a weekly basis, driving from the Hanover, MD office to Fort Meade
Maintain and report assessment and authorization statuses and issues in accordance with organizational guidance
Understand the PRIVAC process and support personnel with new PRIVAC requests and extensions
Required Qualifications
Bachelor's degree in a technical discipline from an accredited college or university plus 10 years of relevant work experience, at least 4 of which must be as an ISSO on programs and contracts of similar scope, type, and complexity. An additional 4 years of experience may be substituted for the degree.
This position has been designated as requiring IAM Level 1 CWIP certification and requires one of the following baseline certifications: CAP, CND, Cloud+, GSLC, Security+ CE, HCISPP, CASP+ CE, CISM, CISSP (or Associate), or CCISO
Experience with the ICD 503/NIST 800-53 certification and accreditation process
Experience with the Risk Management Framework
Experience developing and maintaining SSPs
Experience with IAVA review and handling
Experience interpreting security scan results
Experience interfacing with system administrators and software engineers
Experience with task tracking systems (e.g., Jira, Redmine, ServiceNow)
Understanding of Public Key Infrastructure-based authentication
Understanding of a variety of security policies, especially within the IC
Understanding of the fundamentals of technical security risk assessment
Understanding of how to perform analysis of alternatives
Able to clearly communicate ideas and status updates to management and other stakeholders
Security Clearance
Active Top Secret clearance with a Polygraph
Benefits
Competitive salary
Company Medical/Dental/Vision plans - Company paid
Short-term Disability, Long-term disability and Life Insurance - Company paid
Business/ First Class travel upgrade for 7 hour or longer flights & company card will be provided for expenses
Vacation / Personal days granted at 25 days per year
Paid Federal Holidays - 11 days
$5,000 Annual Professional Development Fund plus 40 paid hours if in class
401K with 6% company match; all contributions are immediately vested by Employee
Employee will be paid a bonus of $10,000 per employee hired based on their referral
Up to 3 paid Code Red days due to customer closure
