Info System Security Officer (ISSO)

American Systems•Ashburn, VA

About The Position

AMERICAN SYSTEMS is seeking an Information System Security Officer (ISSO) to support Network Operations Center Network Management Support Services. The ISSO serves as a designated security professional for one or more FISMA systems of record and new information systems. The role supports the Assessment and Authorization (A&A) lifecycle, Authority to Operate (ATO) activities, ongoing authorization, continuous monitoring, vulnerability management, and compliance with government security requirements. The ISSO works closely with the Government Program Manager, Technical POC/Task Manager, Information Systems Security Manager (ISSM), COR, system owners, engineers, and security stakeholders. The role requires applying federal and agency security guidance, managing system security documentation and vulnerabilities, coordinating authorization and continuous-monitoring activities, and reporting security status and issues to management. The position may support federal audits, incident investigations, encryption requirements, and cloud-related activities as applicable.

Requirements

Approximately 5–10 years of relevant information systems security, cybersecurity, or security authorization experience for senior ISSO candidates.
In-depth knowledge of the Risk Management Framework (RMF), NIST publications, FISMA, DHS 4300A, and HB 1400-05D.
Demonstrated experience implementing or assessing NIST SP 800-53 controls and supporting A&A, ATO, reaccreditation, or continuous-monitoring activities.
Experience reviewing Nessus or comparable vulnerability scans, tracking ISVMs, managing remediation, and developing or maintaining POA&Ms in an enterprise environment.
Experience preparing or maintaining SSPs, security assessments, risk assessments, contingency plans, ST&E artifacts, ATO packages, waivers, and related security documentation.
Understanding of enterprise networking concepts, infrastructure, architectures, and configuration changes.
Ability to work effectively in a team environment, build rapport with Government and customer organizations, and communicate technical security issues clearly.
Ability to obtain Public Trust.

Nice To Haves

Bachelor’s degree in cybersecurity, information assurance, computer science, information systems, or a related field; equivalent relevant experience may be considered.
Experience supporting a federal or other mission-critical enterprise network operations environment.
Preferred Secret or Top Secret clearance.
CISSP, Security+, Network+, CISA, CAP, or security auditing certification.

Responsibilities

Perform ISSO duties in accordance with DHS 4300A, HB 1400-05D, FISMA guidance, applicable NIST publications, and approved program SOPs.
Lead or support Assessment and Authorization (A&A), reaccreditation, and continuous-monitoring processes for assigned information systems.
Notify security leadership of upcoming accreditation or reaccreditation requirements and coordinate kickoff activities with the agency's Security Authorization Team.
Support transition of designated systems to Ongoing Authorization (OA), also known as continuous monitoring.
Manage Plans of Action and Milestones (POA&Ms), including development, documentation, SME follow-up, remediation tracking, and status reporting.
Review Information Security Vulnerability Management (ISVM) messages, determine applicability, acknowledge notifications, track remediation, and coordinate POA&M creation for unresolved vulnerabilities.
Review weekly network scans and log information, prepare vulnerability summaries, and identify critical and high-risk issues affecting assigned systems.
Maintain system asset inventories, provide updates to the Vulnerability Assessment Team (VAT), and reconcile inventories with DHS detailed asset reports.
Review proposed change requests for compliance with security standards and update asset records and System Security Plans (SSPs) when systems or configurations change.
Develop, review, maintain, and submit A&A and security documentation for Government approval, including SSPs, risk assessments, FIPS 199 categorization assessments, ST&E plans and results, ATO and ATT artifacts, contingency plans, ISAs, waivers, and POA&Ms.
Review and update SSPs annually or when significant system changes occur, and complete annual NIST SP 800-26 or NIST SP 800-53 assessments as required.
Prepare documentation and support the annual Ongoing Authorization Review Management Board (OARMB), DHS/CISA/OMB audits, cybersecurity data calls, and FedRAMP or cloud-as-a-service activities, as applicable.
Assist the Computer Security Incident Response Center (CSIRC) with investigations of security violations and incidents.
Support encryption and security compliance requirements, including FIPS 197 AES-256, FIPS 140-2 validated cryptographic modules, NSA Type 1 or Type 2 encryption, PKI, and emerging FIPS 203, 204, and 205 requirements.
Prepare weekly ISSO reports covering ATO activities, assessments, audits, change requests, POA&Ms, ISVMs, waivers, compliance highlights, and issues requiring management guidance.