USAF - ISSO

cFocus Software Incorporated•Linthicum Heights, MD

2d•Onsite

About The Position

cFocus Software seeks an Information System Security Officer (ISSO) to support a United States Air Force (USAF) program. This is an on-site position in Linthicum Heights, Maryland, requiring an active TS/SCI clearance. The ISSO supports DC3 systems through Risk Management Framework (RMF) authorization, continuous monitoring, compliance, remediation, and security documentation activities. The role coordinates with system owners, ISSMs, engineers, assessors, DevSecOps and operations personnel, and Government stakeholders.

Requirements

Active TS/SCI clearance.
Bachelor of Science in Computer Science, Information Technology, or a related field.
Experience performing ISSO duties and developing or maintaining RMF authorization packages.
Experience preparing SSPs, assessment documentation, control evidence, and POA&Ms in eMASS.
Knowledge of security control assessment, continuous monitoring, STIG compliance, and vulnerability management.
Ability to evaluate security findings, coordinate remediation, and maintain accurate system risk records.
Understanding of authorization boundaries, configuration control, and the security impacts of system changes.
Ability to work with system owners, ISSMs, engineers, assessors, and Government stakeholders.
Strong technical writing, evidence management, and communication skills for reviews and reporting.

Responsibilities

Develop, maintain, and update Authorization to Operate (ATO) and Assess-Only Authorization packages for assigned DC3 systems.
Execute steady-state RMF activities for authorized systems, including ongoing security control assessments, STIG compliance, and remediation tracking.
Prepare initial System Security Plans (SSPs), support Security Assessment Plan execution, and assemble authorization evidence for systems without an ATO.
Maintain current system records in eMASS and work with technical teams to resolve documentation and evidence gaps.
Maintain system-level Plans of Action and Milestones (POA&Ms), track corrective actions and dependencies, and provide updates for enterprise consolidation by the ISSM.
Review vulnerability assessment and configuration compliance results; coordinate remediation, validate closure evidence, and identify overdue or unresolved findings.
Support continuous ATO (cATO) through automated compliance evidence and monitoring data in coordination with DevSecOps and operations personnel.
Assess system changes for security and authorization impacts and maintain consistent boundaries, configurations, inventories, and supporting records.
Track applicable cyber orders, taskers, and directives; coordinate required system changes and prepare compliance documentation or POA&Ms when immediate compliance is not achievable.
Provide the ISSM with system risk information, remediation options, and supporting evidence for enterprise risk analysis and Government risk acceptance decisions.
Coordinate with system owners, assessors, engineers, and the ISSM to prepare packages for Government review and address review findings before planned deployment.
Support incident response by providing system security documentation, assessing control implications, and tracking directed corrective actions.
Maintain security procedures and assessment records; support audits and provide status briefings, compliance evidence, and technical documentation as assigned.