Information System Security Officer (ISSO)

LMI•Remote,

4d•$92,075 - $158,138•Remote

About The Position

LMI is seeking an Information System Security Officer (ISSO) to support its Robotics and Autonomous Systems business unit and Department of War mission partners. The ISSO maintains system security documentation, coordinates Risk Management Framework (RMF) activities, supports Authority to Operate (ATO) packages, and tracks security controls, vulnerabilities, and remediation actions throughout the system lifecycle. The ISSO works with the Information System Security Manager (ISSM), government system owners, assessors, and engineering teams to keep authorization records aligned with deployed systems. The role calls for hands-on DoD authorization experience and the technical judgment to evaluate evidence, identify security gaps, and coordinate corrective actions. This is a remote position requiring an active Secret security clearance and the ability to obtain and maintain Top Secret if required by the assignment. Periodic travel may be required for assessments, customer meetings, and access to approved facilities. Classified work must be performed in approved facilities.

Requirements

Active Secret security clearance, with the ability to obtain and maintain Top Secret if required by the assignment.
At least five years of relevant experience as an ISSO, ISSM, cybersecurity compliance professional, or equivalent practitioner supporting DoD information systems.
Hands-on experience preparing and maintaining DoD RMF authorization packages, including security control documentation, assessment support, POA&M management, and ATO sustainment.
Experience using eMASS, Xacta, or a comparable government authorization system to maintain control responses, assessment evidence, findings, and authorization records.
Working knowledge of NIST SP 800-53 security controls, DISA STIGs, vulnerability management, continuous monitoring, and DoD system authorization requirements.
Ability to interpret vulnerability scan results, technical configurations, system diagrams, and assessment findings, and coordinate evidence-based remediation with engineers and system owners.
Working knowledge of operating systems, networking, identity and access management, encryption, configuration management, and logging sufficient to evaluate security-control implementation.
Current cybersecurity certification relevant to assigned duties and ability to meet applicable DoD 8140 work-role and proficiency-level qualification requirements within customer-required timelines.
Strong technical writing, documentation, organization, and stakeholder coordination skills; ability to manage concurrent deadlines, protect sensitive information, and work independently within a distributed team.
Ability to support periodic travel and perform classified duties at approved facilities.
U.S. citizenship and eligibility for a U.S. Government security clearance.

Nice To Haves

Experience supporting authorizations for cloud-hosted systems in AWS GovCloud, Azure Government, or another government-authorized cloud environment, including control inheritance and shared-responsibility documentation.
Experience supporting systems at DoD Impact Level 4, 5, or 6, including mission applications, data platforms, or environments supporting robotics and autonomous systems.
Familiarity with Kubernetes, containers, DevSecOps, automated security evidence, software supply-chain controls, or security requirements for onboarding applications to an authorized platform.
Experience supporting Special Operations Forces, combatant commands, military service components, or Intelligence Community mission partners.
Experience supporting independent security control assessments or implementing continuous monitoring processes across multiple systems.
CGRC, CISSP, CISM, or a related advanced cybersecurity certification.
Bachelor's or master's degree in cybersecurity, information systems, computer science, or a related discipline.

Responsibilities

Maintain System Security Plans, control implementation statements, system inventories, authorization boundaries, network and data-flow diagrams, and supporting records in eMASS or another customer-approved system.
Support system categorization, control selection, and documentation of inherited and system-specific controls, including shared responsibilities across cloud providers, platform teams, and application owners.
Prepare and maintain authorization packages for initial authorization, renewal, and system changes; coordinate evidence collection, reviews, assessment milestones, and responses to findings.
Maintain Plans of Action and Milestones (POA&Ms), assign and track remediation actions with responsible teams, and document validation and closure evidence.
Review vulnerability scans, Security Technical Implementation Guide (STIG) checklists, and security advisories; coordinate remediation and document unresolved risks for appropriate review.
Execute the approved continuous monitoring plan, coordinating control reviews, scan schedules, account reviews, audit-log reviews, configuration checks, and required reporting.
Evaluate proposed changes to applications, infrastructure, interfaces, and data flows for security impacts; update documentation and coordinate additional assessment or authorization requirements.
Work with cloud, platform, software, and cybersecurity engineers to collect technical evidence from deployed systems and software delivery pipelines, including configuration and vulnerability results.
Support security assessments, inspections, and audits by organizing evidence, responding to assessor questions, and tracking corrective actions through resolution.
Maintain security procedures and support access-control reviews, incident reporting, contingency planning, and recovery exercises in coordination with responsible technical and security teams.
Provide status reports on authorization milestones, monitoring results, vulnerabilities, and overdue actions; elevate risk recommendations to the ISSM and authorized government decision-makers.