Information Systems Security Officer - EW&C

MAG Aerospace•Aberdeen Proving Ground, MD

About The Position

MAG Aerospace is seeking an Information Systems Security Officer (ISSO) to lead cybersecurity activities for Spectrum Core in support of PM EW&C. The role is the program’s authoritative voice on risk, compliance, and system accreditation across tactical, RF, and cloud environments. The ISSO owns the full Risk Management Framework (RMF) lifecycle, from initial categorization through IATT, ATO, and ongoing residual risk management, while synchronizing cybersecurity with engineering, fielding, and operational priorities. Reporting directly to the Government Project Officer, the ISSO provides technically grounded advice on cybersecurity posture, remediation paths, and mission-relevant risks. The role spans NIPR, SIPR, RF systems, and web architectures, and involves cybersecurity implementation across the system. The ISSO collaborates with an independent SCA-V, supports evolving accreditation needs and FCL/DD254 requirements as Airbase onboards to NISS, and helps ensure fielding and assessment activities remain cyber-sound at remote ranges or division sites. Travel is limited to situations where physical presence changes the assessment; pre-briefs and post-briefs may be conducted by VTC. The position uses AI tools to support cyber work, while prohibiting CUI in public models. The position is contingent on the candidate’s ability to meet physical and medical requirements as needed, including applicable federal, state, and local jurisdictional requirements. MAG Aerospace offers eligible employees a Total Rewards package that may include health, life, disability, financial, and retirement benefits, paid leave, professional development, and tuition assistance. The annual salary range is $130,000 to $160,000 USD; compensation depends on factors including location, education, skills, experience, contract affordability, and organizational requirements.

Requirements

At least 5 years of experience is stated as a minimum; the posting also specifies 8 or more years of DoW/DoD cybersecurity experience with hands-on ISSO or equivalent RMF execution.
Current DoD 8140/8570 IAM Level II or Level III qualification; Security+ alone does not meet the IAM II requirement for this role.
Demonstrated ownership of an eMASS or equivalent package through an authorization decision.
Working knowledge of NIST SP 800-53, CNSSI 1253, STIGs, continuous monitoring, and the distinction between IATT and ATO.
Ability to tell a program manager “no” while providing a mitigation, cost, and date.
Experience using AI tools to accelerate cybersecurity work and ability to provide a redacted example.
Bachelor of Science degree; four years of experience may substitute for a B.S. degree.
Ability to meet physical and medical requirements as needed by the position, including applicable jurisdictional requirements.

Nice To Haves

CISSP, CISM, CAP, or CASP+ certification.
RMF experience with RF, sensor, electronic warfare, PNT, or other tactical systems.
Cloud, IL5, or SIPR enclave experience.
Army PdM or PEO ISSO experience.
DEVCOM laboratory systems experience.
ATEC test support experience.
Experience with ACAS, HBSS/ESS, SCAP, STIG Viewer, eMASS, or other A&A tools.
Top Secret clearance.
Bachelor of Science in Engineering, Computer Science, or a related field.

Responsibilities

Own the RMF package end to end, including the SSP, security controls, POA&M, artifacts, and continuous monitoring; use eMASS as the system of record.
Drive IATT for developmental testing and ATO for operational use, including the SIPR instance in Phase 3.
Manage STIGs, vulnerability management, SCAP, ACAS/Nessus or equivalent tools, and configuration baselines; analyze scans and distinguish false positives from genuine findings.
Advise the Project Officer directly on residual risk and fielding impact, and provide concise written recommendations.
Coordinate with the AO, SCA/SCA-V, ISSM, and system owners; prepare assessments while maintaining independent assessment boundaries.
Integrate cybersecurity into system integration, testing, and fielding from the outset, working alongside the Integrator.
Support FCL sponsorship, DD254, and contractor personnel security requirements so Airbase personnel can access the system.
Travel when physical presence changes the assessment and conduct pre-briefs and post-briefs by VTC when appropriate.
Use AI tools to map controls, draft SSP language, summarize STIG results, and develop assessment checklists; do not enter CUI into public models.
Sign the residual-risk memo.