Info System Security Officer (ISSO)

AMERICAN SYSTEMS•Ashburn, VA

7d•$110,800 - $185,100

About The Position

AMERICAN SYSTEMS is seeking an Information System Security Officer (ISSO) to support Network Operations Center Network Management Support Services. The ISSO serves as a designated security professional for one or more FISMA systems of record and new information systems, supporting the Assessment and Authorization (A&A) lifecycle, Authority to Operate (ATO) activities, ongoing authorization, continuous monitoring, vulnerability management, and compliance with government security requirements. The role works closely with the Government Program Manager, Technical POC/Task Manager, Information Systems Security Manager (ISSM), COR, system owners, engineers, and security stakeholders. The ISSO performs security duties in accordance with applicable DHS, FISMA, NIST, and program requirements; supports system authorization and monitoring; maintains security documentation and vulnerability remediation records; and prepares regular reports and materials for reviews, audits, and management. The posting describes senior ISSO candidates as having approximately 5–10 years of relevant experience, while also referencing candidates supporting junior-level ISSO assignments. A bachelor’s degree in a related field is preferred, though equivalent relevant experience may be considered. The role requires the ability to obtain a Public Trust; Secret/Top Secret clearance is preferred. The stated salary range is USD $110,800–$185,100 per year. AMERICAN SYSTEMS offers healthcare benefits, paid leave, retirement plans, insurance programs, and education and training assistance.

Requirements

Senior ISSO candidates should demonstrate approximately 5–10 years of relevant information systems security, cybersecurity, or security authorization experience.
In-depth knowledge of the Risk Management Framework (RMF), NIST publications, FISMA, DHS 4300A, and HB 1400-05D.
Demonstrated experience implementing or assessing NIST SP 800-53 controls and supporting A&A, ATO, reaccreditation, or continuous-monitoring activities.
Experience reviewing Nessus or comparable vulnerability scans, tracking ISVMs, managing remediation, and developing or maintaining POA&Ms in an enterprise environment.
Experience preparing or maintaining SSPs, security assessments, risk assessments, contingency plans, ST&E artifacts, ATO packages, waivers, and related security documentation.
Understanding of enterprise networking concepts, infrastructure, architectures, and configuration changes.
Ability to work effectively in a team environment, build rapport with Government and customer organizations, and communicate technical security issues clearly.
Ability to obtain Public Trust.

Nice To Haves

Bachelor’s degree in cybersecurity, information assurance, computer science, information systems, or a related field; equivalent relevant experience may be considered.
Experience supporting a federal or other mission-critical enterprise network operations environment.
Secret/Top Secret clearance preferred.
CISSP, Security+, Network+, CISA, CAP, or security auditing certification recommended.

Responsibilities

Perform ISSO duties in accordance with DHS 4300A, HB 1400-05D, FISMA guidance, applicable NIST publications, and approved program SOPs.
Lead or support Assessment and Authorization (A&A), reaccreditation, and continuous-monitoring processes for assigned information systems.
Notify security leadership of upcoming accreditation or reaccreditation requirements and coordinate kickoff activities with the agency’s Security Authorization Team.
Support transition of designated systems to Ongoing Authorization (OA), also known as continuous monitoring.
Manage Plans of Action and Milestones (POA&Ms), including development, documentation, SME follow-up, remediation tracking, and status reporting.
Review Information Security Vulnerability Management (ISVM) messages, determine applicability, acknowledge notifications, track remediation, and coordinate POA&M creation for unresolved vulnerabilities.
Review weekly network scans and log information, prepare vulnerability summaries, and identify critical and high-risk issues affecting assigned systems.
Maintain system asset inventories, provide updates to the Vulnerability Assessment Team (VAT), and reconcile inventories with DHS detailed asset reports.
Review proposed change requests for compliance with security standards and update asset records and System Security Plans (SSPs) when systems or configurations change.
Develop, review, maintain, and submit A&A and security documentation for Government approval, including SSPs, risk assessments, FIPS 199 categorization assessments, ST&E plans and results, ATO and ATT artifacts, contingency plans, ISAs, waivers, and POA&Ms.
Review and update SSPs annually or when significant system changes occur, and complete annual NIST SP 800-26 or NIST SP 800-53 assessments as required.
Prepare documentation and support the annual Ongoing Authorization Review Management Board (OARMB), DHS/CISA/OMB audits, cybersecurity data calls, and FedRAMP or cloud-as-a-service activities, as applicable.
Assist the Computer Security Incident Response Center (CSIRC) with investigations of security violations and incidents.
Support encryption and security compliance requirements, including FIPS 197 AES-256, FIPS 140-2 validated cryptographic modules, NSA Type 1 or Type 2 encryption, PKI, and emerging FIPS 203, 204, and 205 requirements.
Prepare weekly ISSO reports covering ATO activities, assessments, audits, change requests, POA&Ms, ISVMs, waivers, compliance highlights, and issues requiring management guidance.