Information Systems Security Officer (ISSO) III

Abacus Technology•Montgomery, AL

3d•Onsite

About The Position

Abacus Technology is seeking an Information Systems Security Officer to provide security and information assurance support for the Air Force Intranet Control (AFINC) III Support program at Maxwell AFB/Gunter Annex. This is a full-time position. The ISSO will assess operational and development environments, threats, vulnerabilities, and interfaces for compliance with government and industry standards. The role implements and manages Assessment and Authorization (A&A) activities under the Risk Management Framework (RMF), maintains system authorizations, and oversees corrective actions and continuous monitoring. The position also supervises program information security activities and an assigned team, and coordinates security assessments, audits, incident response, and risk mitigation. The role requires experience with DoD cybersecurity policies and classified programs, relevant certifications and training, and a current Top Secret clearance with SCI access. Applicants must be U.S. citizens and eligible for access to classified information.

Requirements

At least 5 years of experience in a cybersecurity or information assurance role, including at least 3 years supporting the RMF.
High school diploma or GED.
Hold at least one IAM II certification: CISM, CISSO, CISSP, CISSP-ISSMP, FITSP-M, GCIA, GCIH, GCSA, GICSP, or GSLC.
Hold CAP or Certified in Governance, Risk, and Compliance (CGRC) certification.
Have participated in training for DISA ACAS Supervisor and Operator and DISA Enterprise Mission Assurance Support Service (eMASS).
Experience with DoD cybersecurity policies and implementation of the RMF, such as NIST SP 800 series and CNSSI 1253.
Experience as an ISSO or ISSM supporting classified programs.
Experience assessing and documenting test or analysis data to demonstrate cybersecurity compliance.
Experience using security-related tools, systems, and applications in support of RMF, including NESSUS, ACAS, DISA STIGs, Audit Tools, ESS, eMASS, and PPS.
Outstanding communication skills across all levels of the organization.
Must be a U.S. citizen.
Must hold a current Top Secret clearance with SCI access (TS/SCI).
Must meet eligibility requirements for access to classified information and be subject to a U.S. government security investigation.

Nice To Haves

Additional certifications such as CCNA or Microsoft Certified: Information Security Administrator Associate are preferred.

Responsibilities

Perform security analysis of operational and development environments, threats, vulnerabilities, and internal interfaces to assess compliance with industry and government standards.
Implement RMF Assessment and Authorization processes for new and existing information systems.
Maintain current authorizations to operate (ATO) and, when required, approvals to connect (ATC), and implement corrective actions identified in plans of action and milestones.
Facilitate development of Memorandums of Understanding (MOU), Interconnection Security Agreements (ISA), and Risk Acceptance Letters.
Develop an Information System Continuous Monitoring (ISCM) strategy and monitor proposed or actual system and environmental changes for continued compliance.
Audit systems to ensure the integrity of their security posture.
Conduct assessments and test or analyze data to document compliance with security requirements.
Conduct risk assessments and investigations, recommend risk mitigations, and coordinate incident response activities.
Conduct periodic hardware and software inventory assessments.
Supervise development and deployment of program information security for program systems in accordance with program and enterprise requirements, policies, standards, guidelines, and procedures.
Manage an assigned team to facilitate effective RMF execution.
Coordinate and participate in security assessments and audits.
Prepare, review, and present technical reports and briefings.
Register, maintain, verify, submit exceptions for, annually review, or decommission system ports, protocols, and services (PPS) as necessary to ensure compliance with the DoD PPS Category Assurance List (CAL) and DoD PPS Vulnerability Assessment reports.