Information Systems Security Officer

CACI International•Aurora, CO

8d•$75,200 - $158,100•Hybrid

About The Position

The Information Systems Security Officer (ISSO) will assist the Information System Security Manager (ISSM) with authorization, security-control implementation, continuous monitoring, vulnerability management, and maintenance of the cybersecurity posture for assigned authorization boundaries. You will collaborate with software developers, systems engineers, and government stakeholders to navigate the Risk Management Framework (RMF) lifecycle and maintain the Authority to Operate (ATO) for complex cloud environments.

Requirements

3-6 years of experience in Cybersecurity, Information Assurance, or related background.
Active TS/SCI w/Poly.
DoD 8140 IAT Level II Compliance (e.g., Security+, CCNA Security, or SSCP).
RMF Lifecycle: Support RMF, IATT, ATO, and continuous-monitoring activities for cloud environments.
Control Implementation: Knowledge of NIST 800-53 and 800-171 control sets, including managing control inheritance and applying overlays.
Governance & Documentation: Develop and maintain SSPs, SCTMs, POA&Ms, SOPs, contingency plans, configuration documentation, and assessment evidence.
Technical Oversight: Experience reviewing system changes for security impact and collaborating with dev teams to integrate new technologies securely.
Continuous Monitoring: Proficiency in conducting security inspections, audits, and vulnerability analysis to track patch effectiveness and system health.

Nice To Haves

Experience working with governance risk and compliance tools (i.e. Xacta, SNOW, etc.).
Experience utilizing common industry tools (i.e. Nessus, Splunk, Anchore, etc.).
Experience with Cloud security. Analyzing evidence from CloudTrail, Config, Security Hub, Guard Duty, Cloud Watch, Systems Manager, Inspector, and AWS Backup.

Responsibilities

RMF & ATO Management: Build and update standard RMF packages, including the Systems Security Plan (SSP), Plan of Actions and Milestones (POAMs), hardware and software inventories, and network topology diagrams.
Security Engineering & Cloud Oversight: Drive "security by design" by reviewing technical change requests, evaluating new technologies, and providing security oversight for cloud-based platforms (AWS/Azure).
Vulnerability & Risk Mitigation: Perform vulnerability/risk assessment analysis to support continuous monitoring and the certification and accreditation process.
Technical Compliance & Monitoring: Establish continuous monitoring protocols to track security posture, enforce cybersecurity policies, and brief complex technical risks to senior stakeholders.