Information System Security Officer (ISSO)

Tria Federal • Washington, DC

4d • Hybrid

About The Position

Tria Federal is seeking a motivated, detail-oriented Information System Security Officer (ISSO) to research, develop, implement, test, and review information security measures that protect information and prevent unauthorized access. The role emphasizes knowledge of infrastructure devices such as firewalls, routers, and switches. The candidate must be able to work onsite at customer headquarters in Washington, DC, one to two times per week.

The ISSO conducts and maintains system security authorizations, prepares security documentation and authorization packages, assesses risk, and supports ongoing compliance with applicable NIST requirements. The role requires familiarity with DHS, CSAM, and the NIST Risk Management Framework (RMF), as well as the ability to work independently and communicate complex system security information clearly.

Requirements

• DHS Public Trust.
• Three to five years of cybersecurity experience.
• Working knowledge and experience with CSAM and the NIST RMF.
• Solid knowledge of the process for obtaining a system ATO and the requirements for maintaining an ATO.
• Experience working with system stakeholders to assess and manage system cybersecurity risk.
• Ability to synthesize complex IT system information and communicate system status and requirements in written products and verbal presentations.
• Ability to write clear, concise, effective security control implementation statements.
• Familiarity with configuration settings and vulnerability management analysis of infrastructure devices.
• Ability to draft a complete ATO package, including the SSP.
• Ability to work independently and efficiently, with minimal direct supervision and within given timelines.
• Security+ certification.
• Bachelor of Science in Computer Science, Information Technology, or a related field.

Nice To Haves

• CISSP certification.
• CGRC (formerly CAP) certification.
• CISM certification.
• DHS experience.
• Familiarity with the CSAM GRC Tool.

Responsibilities

• Conduct initial security assessments and obtain system Authorization to Operate (ATO) in line with NIST SP 800-37 Rev. 2.
• Maintain the security authorization or ATO of assigned systems.
• Continuously update security authorization documentation to maintain assigned systems’ ATOs or meet system go-live dates.
• Select baseline security controls for IT systems using the CSAM Governance, Risk, and Compliance (GRC) Tool, and tailor controls where appropriate.
• Document relevant NIST 800-53 security controls for assigned IT systems in the System Security Plan (SSP).
• Perform and document initial and annual risk self-assessments for assigned systems.
• Develop and document supporting Security Assessment and Authorization (A&A) artifacts, including PTA, SSP, ITCP, BIA, CMP, MOU, and ISA.
• Produce security authorization packages for Authorizing Official (AO) signature, including the ATO.
• Track deployment of software to the environment that is not part of the base image.
• Conduct security impact analyses of proposed changes and provide recommendations.
• Analyze configuration settings, implementation of STIGs, and manual checklists.
• Generate and manage Plans of Action & Milestones (POA&Ms), with meaningful milestones and clear, concise implementation statements for each non-compliant control on assigned IT systems.

Benefits

• Top-tier benefits package supporting physical, mental, and financial health and wellness.
• Opportunities to learn new skills, take on new challenges, and advance professionally.
• Culture of inclusion and opportunity.

What This Job Offers

• Job Type: Full-time
• Career Level: Mid Level