Information System Security Officer

Peraton•Annapolis Junction, MD

8d•$104,000 - $166,000•Onsite

About The Position

Peraton is seeking an Information System Security Officer (ISSO) to support our customer onsite in Annapolis Junction, MD. The ISSO will assist the Information System Security Manager (ISSM) with information assurance efforts and systems across numerous environments. This role involves performing ISSO roles and responsibilities as prescribed by the JSIG and other applicable regulations. The position requires executing and maintaining Risk Management Framework (RMF) activities, including control implementation oversight, evidence collection, assessment support, Plan of Action & Milestones (POA&M) management, and continuous monitoring. The ISSO will maintain security authorization artifacts such as the System Security Plan (SSP), control narratives, diagrams, inheritance/leverage controls, Configuration Management (CM) plan, incident handling plan, contingency artifacts, and user/administrator procedures. Key responsibilities include operating continuous monitoring processes such as vulnerability management, configuration compliance, patching coordination, scan result triage, risk acceptance, and remediation verification. The role also involves reviewing and approving security-relevant changes through configuration/change control and validating security configurations after major upgrades. Additionally, the ISSO will support incident response and reporting, including participating in investigations, coordinating containment actions, preserving evidence, and contributing to post-incident lessons learned. Ensuring least privilege/access governance through account management oversight, privileged access workflows, periodic access reviews, and audit compliance requirements is also crucial. The ISSO will translate security requirements into implementation guidance for engineering teams, aiming for clear, testable, and automatable solutions where possible.

Requirements

Active Top Secret clearance with SCI eligibility
5 years with BS/BA; 3 years with MS/MA; 4 additional years of experience may be considered in lieu of degree
Security+ or equivalent certification (DoD 8570 IAM Level II)
Experience with SAP assessments and authorizations
3+ years experience with Authority to Operate (ATO) process, continuous monitoring, POA&Ms, Security Authorizations (SA), NIST 800-37, NIST 800-53 Rev4/ Rev5, working with Information System Owners (ISO) and Program Managers (PM)
Experience with SCAP, STIGs, and other compliance tools
Proven written and verbal communication skills, and the ability to work well with team members

Nice To Haves

Experience with SCRUM methodologies
Experience with Ongoing Authorizations
Experience with Splunk and/or other auditing compliance tools
Experience with ACAS, Nessus, and/or other vulnerability scanners

Responsibilities

Assist the Information System Security Manager (ISSM) with information assurance efforts, and systems across numerous environments
Perform Information System Security Officer (ISSO) roles and responsibilities as prescribed by the JSIG and other applicable regulations
Execute and maintain RMF activities (e.g., control implementation oversight, evidence collection, assessment support, POA&M management, continuous monitoring)
Maintain security authorization artifacts (e.g., SSP, control narratives, diagrams, inheritance/leverage controls, CM plan, incident handling plan, contingency artifacts, user/admin procedures)
Operate continuous monitoring: vulnerability management, config compliance, patching coordination, scan result triage, risk acceptance, and remediation verification
Review and approve security-relevant changes through configuration/change control and validate security configurations after major upgrades
Support incident response and reporting: participate in investigations, coordinate containment actions, preserve evidence, and contribute to post-incident lessons learned
Ensure least privilege/access governance: account management oversight, privileged access workflows, periodic access reviews, and audit compliance requirements
Translate security requirements into implementation guidance that engineering teams can operationalize (clear, testable, and automatable where possible)