Information Systems Security Officer (ISSO)

Second Front Systems•Washington, DC

1d•$150,000 - $170,000

About The Position

Second Front Systems is seeking a detail-oriented, mission-focused, technically grounded Information Systems Security Officer to strengthen its cybersecurity and DevSecOps organization. The role supports DoD IL4/IL5 authorization environments and continuous monitoring operations, executing the Risk Management Framework (RMF) lifecycle and maintaining Game Warden and supporting system authorizations across DoD ATO programs. The ISSO helps ensure security posture withstands assessor and Authorizing Official scrutiny and keeps systems accredited and compliance-ready. The ISSO owns eMASS authorization packages, manages DISA PPSM registrations, drives POA&M remediation with engineering, conducts continuous monitoring, and translates DoD policy and RMF guidance into actionable technical direction. The role bridges compliance requirements with cloud-native architecture patterns, including AWS, Kubernetes, containers, and CI/CD, and authors assessor-ready RMF artifacts and control narratives. It partners with ISSMs, assessors, Authorizing Officials, Product, and Engineering teams to maintain authorization packages, manage monitoring workflows, and ensure defensible evidence collection. Candidates must reside in an approved hiring hub: DC/Maryland/Virginia or Denver/Colorado Springs, Colorado. The position is full-time, with flexible remote work opportunities. U.S. citizenship and an active Secret security clearance are required.

Requirements

3–5 years of hands-on DoD cybersecurity, RMF authorization, or information assurance experience, including direct ISSO or equivalent compliance work supporting DoD ATO packages.
Demonstrated proficiency building and maintaining eMASS authorization packages.
Working knowledge of DISA PPSM registration, ports, protocols, services processes, CAL, and boundary/data-flow documentation.
Strong practical knowledge of NIST 800-53 (Rev. 4/5), NIST 800-37 RMF, and DoD-specific implementation guidance.
Familiarity with DISA STIGs, STIG Viewer/SCC, ACAS, IAVM, DISA Cloud Computing SRG, and continuous monitoring standards.
Solid understanding of AWS, containers, Kubernetes, and CI/CD, including how cloud-native patterns map to technical security controls.
Strong written communication skills for producing assessor-ready documentation and clear control narratives.
Active U.S. Secret security clearance.
DoD 8570/8140 IAM Level I or IAT Level II baseline certification, such as Security+, CISSP, or equivalent; required or obtainable within 90 days.
U.S. citizenship.
Residence in one of the approved hiring hubs: DC/Maryland/Virginia or Denver/Colorado Springs, Colorado.

Responsibilities

Execute all phases of the NIST SP 800-37 DoD RMF lifecycle—categorization, control selection, implementation, assessment, authorization, and continuous monitoring—for systems in DoD IL4/IL5 environments.
Own eMASS authorization packages end-to-end, including control implementation details, test results, artifacts, and continuous monitoring status.
Manage DISA PPSM registrations and reconcile ports, protocols, and services data flows with CAL and boundary architecture.
Author System Security Plans, control implementation narratives, Plans of Action & Milestones, and supporting RMF artifacts reflecting cloud architecture and operating reality.
Drive continuous monitoring operations, including monthly POA&M updates, vulnerability and patch reporting, IAVM compliance, significant change reviews, and periodic assessments; work with engineering to close findings.
Validate STIG compliance and analyze ACAS/Tenable Nessus vulnerability scan results, tracking remediation against NIST 800-53 and DoD requirements.
Serve as the technical point of contact for ISSMs, assessors, and Authorizing Officials during assessments, readiness reviews, and audits.
Partner with Product and Engineering to map AWS, container, Kubernetes, and CI/CD controls to DoD RMF and NIST 800-53 requirements and provide defensible evidence.

Benefits

Potential eligibility for equity awards and discretionary bonuses.
100% employer-paid medical, dental, and vision coverage for the employee and dependents.
401(k) with a 3% company contribution.
Wellness benefits, including a One Medical membership, mental health resources, and family planning support.
Equity incentive plan.
New-hire technology and home office stipend.
Annual professional development stipend.
Flexible paid time off and all federal holidays.
Generous parental leave.
Flexible remote work opportunities.
Employee referral bonus program.