Information Systems Security Officer - TS/SCI REQUIRED

TEKsystems•Herndon, VA

2d•$70 - $127•Onsite

About The Position

TEKsystems is seeking an Information Systems Security Officer to support the authorization and ongoing security of mission applications, cloud infrastructure, and enterprise core services. The ISSO works with Government security personnel, software developers, and infrastructure engineers to maintain security documentation, assess risk, and ensure systems meet applicable Department of Defense and Intelligence Community requirements. The role connects security requirements to how systems are built and operated, including review of technical evidence, investigation of compliance gaps, and coordination with engineers to resolve findings as software, infrastructure, and system configurations change. The posting describes the position as full-time and on-site at a Government facility; it also identifies Herndon, Virginia as the contract work location. The posting lists compensation of $70.00–$127.00 per hour, subject to qualifications, experience, location, and other factors.

Requirements

Bachelor’s degree in a technical or managerial discipline, or a high school diploma or high school equivalency certificate plus more than seven years of relevant practical experience in lieu of a degree.
At least five years of practical experience in cybersecurity, engineering, Test and Evaluation (T&E), or Assessment and Authorization (A&A), formerly Certification and Accreditation (C&A); more than seven years if qualifying through the high-school-equivalency alternative.
Active Top Secret/Sensitive Compartmented Information (TS/SCI) clearance with a Counterintelligence (CI) Polygraph.
Prior experience supporting the Intelligence Community.
Experience using information assurance tools, including eMASS and ACAS.
Experience performing ISSO duties or comparable information systems security and authorization responsibilities.
Experience supporting RMF activities and developing or maintaining system authorization packages.
Experience documenting security control implementation, collecting assessment evidence, and tracking findings through resolution.
Understanding of applicable Department of War and Intelligence Community security requirements and assessment processes.
Experience reviewing vulnerability assessments and security configuration findings and coordinating remediation with technical personnel.
Understanding of system boundaries, data flows, access controls, audit logging, configuration management, and continuous monitoring.
Ability to assess security implications of system changes and explain risks to technical and nontechnical stakeholders.
Strong technical writing, organizational, and communication skills.
Ability to meet applicable cybersecurity workforce qualification requirements for the assigned position; a Full Security Control Assessor qualification may also be required depending on assigned duties.

Nice To Haves

Meet DoD 8140 / 8570 IAM Level II or III baseline requirements, such as CISSP, CISM, or CAP/ISC2 CGRC.
Experience supporting authorization activities under Intelligence Community Directive (ICD) 503 and applicable agency guidance.
Experience assessing Amazon Web Services (AWS) or AWS GovCloud environments, including deployments subject to Department of Defense Impact Level 5 requirements.
Familiarity with Kubernetes and Red Hat OpenShift security considerations, including workload isolation, access controls, image security, and logging.
Experience using automated security testing results and deployment records as evidence supporting assessment and continuous monitoring.
Experience applying Security Technical Implementation Guides (STIGs), validating configuration compliance, and supporting security control assessments.
Familiarity with Identity, Credential, and Access Management (ICAM), Public Key Infrastructure (PKI), certificate management, encryption, and secrets management.
Experience assessing Zero Trust controls involving identity, devices, networks, applications, and data.
Certified in Governance, Risk and Compliance (CGRC), Certified Information Systems Security Professional (CISSP), or comparable credentials.

Responsibilities

Support Risk Management Framework (RMF) activities to obtain and maintain Authority to Operate (ATO) for systems across applicable classification levels.
Develop and maintain authorization documentation, including System Security Plans (SSPs), security control implementation statements, system boundary descriptions, and supporting evidence.
Coordinate with system owners, Information System Security Managers (ISSMs), assessors, and engineering teams to prepare authorization packages and resolve assessment findings.
Maintain Plans of Action and Milestones (POA&Ms), track remediation progress, and communicate unresolved risks and dependencies.
Use DISA Enterprise Mission Assurance Support Service (eMASS) to maintain authorization records, security control documentation, assessment evidence, and remediation status, as applicable.
Review Assured Compliance Assessment Solution (ACAS) scan results, security configuration assessments, and application security testing reports; work with technical teams to prioritize and validate remediation.
Assess the security impact of software releases, infrastructure changes, new integrations, and changes to the authorization boundary.
Support continuous monitoring by maintaining current security evidence, reviewing control effectiveness, and reporting changes in system risk.
Work with cloud and DevSecOps engineers to incorporate security requirements and evidence collection into development and deployment workflows.
Review access controls, privileged access, audit logging, configuration baselines, and protection of sensitive data.
Support security incident reporting, investigation, corrective actions, and updates to relevant documentation and procedures.
Apply appropriate security overlays and support supply chain risk management activities.
Prepare security status reports and brief Government stakeholders on authorization progress, findings, and remediation priorities.