Information System Security Officer (ISSO)

CACI•Annapolis Junction, MD

About The Position

CACI is seeking an experienced Information System Security Officer to support cybersecurity operations, risk management, and compliance activities in a Department of Defense environment. The ISSO collaborates with the Information Systems Security Manager and technical teams to maintain the security posture of mission-critical information systems and support Assessment and Authorization activities. The role applies expertise in the Risk Management Framework, vulnerability management, and security compliance to help ensure systems meet federal and DoD cybersecurity requirements. The position offers a collaborative environment focused on technical excellence, accountability, continuous improvement, and support for critical customer missions. The employee will support assigned information systems, programs, and enclaves; maintain authorization documentation and compliance records; assess vulnerabilities and security controls; and communicate findings and remediation recommendations to technical and nontechnical stakeholders.

Requirements

Active TS/SCI clearance with Polygraph.
High school diploma or GED and at least 6 years of relevant experience, or a bachelor's degree and at least 2 years of relevant experience.
Information Assurance Technical (IAT) Level II certification (CompTIA Security+ CE).
CompTIA A+ CE certification.
CompTIA Network+ CE certification.
Knowledge of DoD cybersecurity policies, RMF processes, and A&A requirements.
Experience supporting cybersecurity compliance, vulnerability management, system security documentation, and risk mitigation.
Familiarity with ACAS/Nessus, STIG assessments, POA&Ms, SSPs, and continuous monitoring processes.
Knowledge of configuration management, security patching, and information system security controls.
Strong written and verbal communication, organizational, and interpersonal skills, including the ability to communicate technical information to diverse audiences.

Nice To Haves

Experience independently managing complex ATO submissions and coordinating with Security Control Assessors and Authorizing Officials.
Experience supporting multiple interconnected systems or enterprise-level cybersecurity environments.
Experience leading cybersecurity readiness reviews, compliance inspections, or security audits.
Advanced proficiency in analyzing vulnerability trends and developing long-term cybersecurity improvement strategies.
Experience collaborating with cross-functional engineering, infrastructure, and program management teams to resolve complex security challenges.

Responsibilities

Support the ISSM in maintaining the operational cybersecurity posture of assigned information systems, programs, and enclaves.
Provide cybersecurity oversight and support for Assessment and Authorization activities in accordance with FISMA, DoD requirements, and the RMF.
Develop, review, and maintain System Security Plans, security authorization packages, and supporting documentation required to obtain and maintain Authorities to Operate.
Review authorization packages for completeness, including CCIs, SCA-V results, STIGs, POA&Ms, and cybersecurity strategies.
Conduct vulnerability assessments using ACAS, Nessus, and other approved security scanning tools; identify risks and recommend remediation.
Perform STIG assessments, monitor IAVM compliance, and track corrective actions through completion.
Maintain configuration management records for security software, hardware, firmware, servers, workstations, and network infrastructure.
Coordinate security patches, system upgrades, and configuration changes to maintain system security and compliance.
Develop and maintain cybersecurity documentation, including system architecture, security boundaries, hardware and software inventories, data flows, PPSM records, and risk assessments.
Evaluate applications, infrastructure, enclaves, and enterprise environments to identify cybersecurity risks and assess proposed accreditation boundaries.
Implement and enforce cybersecurity policies, standards, and Standard Operating Procedures.
Track and report security authorization statuses, vulnerabilities, compliance findings, and remediation progress.
Communicate technical cybersecurity findings and recommendations to technical and nontechnical stakeholders.