Information Systems Security Officer III

Parallax Advanced Research • Beavercreek, OH

9d • Onsite

About The Position

The Information Systems Security Officer (ISSO) III protects customer information systems and maintains their security posture across the full system lifecycle. The role translates security requirements into practical action, maintains authorization documentation, and helps technical teams identify, prioritize, and resolve cybersecurity risks. The ISSO III works closely with Information System Security Managers (ISSMs), system owners, administrators, engineers, assessors, and cybersecurity service providers, and communicates security risks and remediation priorities to technical teams and program leadership. This is an individual contributor position with no supervisory responsibilities. The position is full-time and on-site at Parallax Advanced Research headquarters in Beavercreek, Ohio, with conditional telework for unclassified work.

Requirements

• U.S. citizenship.
• Active TS/SCI clearance and ability to maintain it.
• Five or more years of relevant cybersecurity or information assurance experience, including hands-on ISSO, ISSE, or comparable RMF and authorization responsibilities.
• DoD 8140 workforce qualification for the assigned DCWF work role and proficiency level (for example, Security+ CE or higher), as required by the supported contract.
• Demonstrated experience developing and maintaining authorization packages, supporting assessments, and managing POA&Ms through remediation and closure.
• Working knowledge of NIST SP 800-37, NIST SP 800-53, and applicable customer cybersecurity requirements.
• Experience with eMASS, Xacta, or a comparable governance, risk, and compliance platform.
• Ability to interpret vulnerability findings, security configurations, technical diagrams, and security control evidence in Windows, Linux, network, or cloud environments.
• Strong technical writing, analytical, organizational, and communication skills, with the ability to manage competing priorities across multiple teams.
• Ability to travel up to 15 percent.

Nice To Haves

• Bachelor's degree in cybersecurity, information technology, computer science, or a related field, or equivalent experience where permitted by the customer contract.
• Advanced credentials such as CGRC, CISSP, CISM, or CCSP.
• Experience supporting classified, SCI, or SAP environments, including JSIG, ICD 503, or the DCSA Assessment and Authorization Process Manual (DAAPM).
• Experience supporting federal or defense systems, complex authorization boundaries, or multiple concurrent authorization packages.
• Experience with AWS GovCloud, Azure Government, cloud control inheritance, FedRAMP, or DevSecOps environments.
• Experience automating evidence collection, compliance reporting, or recurring security tasks.

Responsibilities

• Lead assigned Risk Management Framework (RMF) and Assessment and Authorization (A&A) activities, including preparing and maintaining authorization packages and supporting evidence.
• Develop and maintain System Security Plans, security control implementation statements, Plans of Action and Milestones (POA&Ms), diagrams, inventories, and supporting security procedures.
• Maintain accurate system boundaries, asset records, interconnection documentation, and shared or inherited control descriptions.
• Prepare risk recommendations, exception requests, and security status reports for the ISSM, system owner, and designated approval authorities.
• Perform continuous monitoring, validate security control evidence, support assessments and inspections, and track authorization conditions and recurring deliverables.
• Analyze vulnerability scans and configuration assessments, including ACAS/Nessus, SCAP, and DISA STIG results; work with technical owners to prioritize remediation and verify closure evidence.
• Review security logs, access controls, and configuration findings to identify risks and suspicious activity.
• Review proposed system, software, network, and cloud changes; document security impacts and coordinate required reviews before implementation.
• Coordinate with engineering and operations teams to incorporate security requirements into development, deployment, and sustainment activities.
• Report suspected incidents through approved channels and coordinate with the incident response team or Cybersecurity Service Provider (CSSP).
• Support incident documentation, evidence preservation, and corrective actions; validate that required security controls and monitoring are restored after recovery.
• Support security awareness and role-based training.
• Share knowledge with less experienced staff and improve the quality and consistency of security documentation.
• Follow requirements for handling classified information and systems.
• Perform other duties as assigned.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior
• Education Level: No Education Listed