Information Systems Security Officer III

Parallax Advanced Research•Beavercreek, OH

8d•Onsite

About The Position

The Information Systems Security Officer (ISSO) III protects customer information systems and maintains their security posture throughout the system lifecycle. The role translates security requirements into practical actions, maintains authorization documentation, and helps technical teams identify, prioritize, and resolve cybersecurity risks. The ISSO III works with Information System Security Managers (ISSMs), system owners, administrators, engineers, assessors, and cybersecurity service providers, and communicates security risks and remediation priorities to technical teams and program leadership. This is an individual contributor position with no supervisory responsibilities. The position leads assigned Risk Management Framework (RMF) and Assessment and Authorization (A&A) activities; develops and maintains authorization packages, security plans, control documentation, POA&Ms, diagrams, inventories, and procedures; supports continuous monitoring and assessments; analyzes vulnerability and configuration findings; reviews system changes for security impacts; and coordinates incident response support. It also supports security training, improves documentation, and follows requirements for handling classified information and systems. The role is full-time and on-site at Parallax HQ in Beavercreek, Ohio. On-site work may include secure areas where personal electronic devices are not permitted, with conditional telework for unclassified work. Travel up to 15 percent is required.

Requirements

U.S. citizenship.
Active TS/SCI clearance and ability to maintain it.
Five or more years of relevant cybersecurity or information assurance experience, including hands-on ISSO, ISSE, or comparable RMF and authorization responsibilities.
DoD 8140 workforce qualification for the assigned DCWF work role and proficiency level, such as Security+ CE or higher, as required by the supported contract.
Demonstrated experience developing and maintaining authorization packages, supporting assessments, and managing POA&Ms through remediation and closure.
Working knowledge of NIST SP 800-37, NIST SP 800-53, and applicable customer cybersecurity requirements.
Experience with eMASS, Xacta, or a comparable governance, risk, and compliance platform.
Ability to interpret vulnerability findings, security configurations, technical diagrams, and security control evidence in Windows, Linux, network, or cloud environments.
Strong technical writing, analytical, organizational, and communication skills, including the ability to manage competing priorities across multiple teams.
Ability to travel up to 15 percent.

Nice To Haves

Bachelor's degree in cybersecurity, information technology, computer science, or a related field, or equivalent experience where permitted by the customer contract.
Advanced credentials such as CGRC, CISSP, CISM, or CCSP.
Experience supporting classified, SCI, or SAP environments, including JSIG, ICD 503, or the DCSA Assessment and Authorization Process Manual (DAAPM).
Experience supporting federal or defense systems, complex authorization boundaries, or multiple concurrent authorization packages.
Experience with AWS GovCloud, Azure Government, cloud control inheritance, FedRAMP, or DevSecOps environments.
Experience automating evidence collection, compliance reporting, or recurring security tasks.

Responsibilities

Lead assigned Risk Management Framework (RMF) and Assessment and Authorization (A&A) activities, including preparing and maintaining authorization packages and supporting evidence.
Develop and maintain System Security Plans, security control implementation statements, Plans of Action and Milestones (POA&Ms), diagrams, inventories, and supporting security procedures.
Maintain accurate system boundaries, asset records, interconnection documentation, and shared or inherited control descriptions.
Prepare risk recommendations, exception requests, and security status reports for the ISSM, system owner, and designated approval authorities.
Perform continuous monitoring, validate security control evidence, support assessments and inspections, and track authorization conditions and recurring deliverables.
Analyze ACAS/Nessus, SCAP, and DISA STIG vulnerability scan and configuration assessment results; coordinate remediation priorities with technical owners and verify closure evidence.
Review security logs, access controls, and configuration findings to identify risks and suspicious activity.
Review proposed system, software, network, and cloud changes, document security impacts, and coordinate required reviews before implementation.
Coordinate with engineering and operations teams to incorporate security requirements into development, deployment, and sustainment activities.
Report suspected incidents through approved channels and coordinate with the incident response team or Cybersecurity Service Provider (CSSP).
Support incident documentation, evidence preservation, and corrective actions; validate restoration of required security controls and monitoring after recovery.
Support security awareness and role-based training.
Share knowledge with less experienced staff and improve the quality and consistency of security documentation.
Follow requirements for handling classified information and systems.
Perform other duties as assigned.