Information Systems Security Officer (ISSO) II

Pyramid Systems Inc•Fairfax, IA

4d•$83,000 - $103,000

About The Position

The Information Systems Security Officer II (ISSO II) supports the security and compliance of assigned information systems and networks in accordance with applicable government, customer, and organizational requirements. With at least three years of relevant experience, the ISSO performs recurring security activities with limited supervision, maintains System Security Plans and related authorization documentation, evaluates security controls, conducts vulnerability and continuous monitoring activities, and supports incident response and remediation. The position works directly with program managers, system administrators, security engineers, and internal and external customers throughout the system life cycle. The ISSO also implements procedures for the protection, handling, and accountability of classified systems, media, and equipment, and evaluates system changes for security and documentation impacts.

Requirements

Minimum of three years of relevant experience in information system security, cybersecurity, information technology, system administration, network administration, security compliance, or a related field.
Bachelor's degree in cybersecurity, information technology, computer science, management information systems, or a related field; equivalent relevant education, training, certifications, and experience may be considered.
Ability to obtain and maintain the security clearance and customer access required for the position.
Knowledge of cybersecurity principles, including confidentiality, integrity, availability, least privilege, defense in depth, and risk management.
Working knowledge of information system security controls, authorization documentation, continuous monitoring, vulnerability management, configuration management, and incident response.
Working knowledge of government cybersecurity and classified information system requirements applicable to the assigned environment.
Knowledge of Windows and/or Linux operating systems, networks, user account administration, security configurations, audit logs, and common security technologies.
Skill in preparing and maintaining System Security Plans, control narratives, risk assessments, Plans of Action and Milestones, reports, and supporting evidence.
Skill in operating vulnerability scanning, endpoint security, log review, ticketing, collaboration, and standard office productivity tools.
Skill in analyzing security findings, identifying potential risk, determining appropriate next steps, and tracking corrective actions.
Ability to interpret and apply security policies, technical guidance, standard operating procedures, contract requirements, and customer direction.
Ability to independently manage recurring security activities and moderately complex assignments while recognizing matters requiring escalation.
Ability to communicate technical, risk, and compliance information clearly in writing and verbally to technical and nontechnical audiences.
Ability to coordinate across functional teams, manage competing priorities, meet deadlines, and maintain accurate and complete records.
Ability to protect sensitive and classified information and exercise sound judgment, discretion, and professional integrity.
Demonstrated experience with security documentation, vulnerability management, system administration, networking, security controls, or compliance activities.

Nice To Haves

Baseline cybersecurity certification meeting contract or customer requirements is preferred or may be required within a specified period after hire.

Responsibilities

Perform information system security activities with limited supervision, applying established requirements and professional judgment to routine and moderately complex assignments.
Prepare, maintain, and update System Security Plans, security control documentation, risk assessments, Plans of Action and Milestones, and other authorization artifacts.
Coordinate system authorization and continuous monitoring activities, including evidence collection, control reviews, documentation updates, and status reporting.
Conduct vulnerability scans, analyze results, document findings, recommend corrective actions, and track remediation through validation and closure.
Monitor assigned systems for compliance with approved security configurations, access requirements, operating procedures, and authorization conditions.
Review proposed hardware, software, configuration, account, and network changes; evaluate security impacts; and ensure required approvals and documentation are completed.
Conduct recurring user account, access authorization, security training, audit log, media, and configuration reviews, and document results.
Identify, document, and report suspected security incidents, and support their investigation and mitigation according to established procedures.
Implement and maintain procedures for the protection, control, storage, transfer, and disposition of classified systems, media, and equipment.
Advise technical staff and program personnel on established security requirements, identified risks, documentation needs, and corrective actions.
Coordinate with internal and external stakeholders to resolve security findings, obtain required evidence, and maintain authorization schedules.
Maintain accurate security records and provide clear status reports on risks, findings, remediation activities, and assigned deliverables.
Research applicable cybersecurity requirements and recommend updates to procedures, documentation, or security practices.
Escalate significant risks, incidents, unresolved findings, and matters requiring management or senior security review.