ISSO 5

Newport News Nuclear BWXT Los Alamos LLC•Los Alamos, NM

9h•Onsite

About The Position

The Information Systems Security Officer (ISSO) Lead / Alternate Information System Security Manager (AISSM) provides senior‑level cybersecurity oversight and technical support across assigned information systems to ensure compliance with Department of Energy (DOE), National Nuclear Security Administration (NNSA), federal, and N3B cybersecurity requirements. This position leads to execution of system authorization activities, continuous monitoring, vulnerability management, and mentorship of ISSO staff. The role advises and shares ownership/authorship of System Security Plans (SSPs), Security Assessment Reports (SARs), Assessment & Authorization (A&A) packages, control narratives, and other administrative RMF documents. The ISSO Lead also serves as the Alternate Information System Security Manager (AISSM), covering ISSM responsibilities during periods of absence, major escalations, or elevated operational needs.

Requirements

Excellent interpersonal skills: written and verbal communication, effective listening, conflict resolution
Extensive experience as an ISSO, cybersecurity analyst, or security engineer within DOE/NNSA environments.
Deep knowledge of the NIST Risk Management Framework (RMF), NIST SP 800‑53, and A&A processes.
Deep working knowledge of NIST SP 800‑series publications (specifically 800‑37, 800‑53, and 800‑137)
Strong proficiency in cybersecurity toolsets (logging, endpoint protection, vulnerability management).
Demonstrated capability to support elevated security leadership roles, including AISSM or ISSM support functions.
Familiarity with security tools such as Tenable (Nessus, Security Center), Splunk, SCAP Tool, STIG Viewer
Familiarity with federal IT compliance structures (e.g., FISMA, DOE Order 205.1C/D, FedRAMP)
Experience using federal GRC tools (e.g., XACTA, eMASS, Archer, RegScale) to manage risk packages
Related certifications including CISSP, CISM, CASP, Security+, CHFI, CEH
Must be able to maintain confidentiality when working with sensitive information.
All qualified applicants will be considered; however, the successful candidate must be able to obtain and maintain a Q clearance from the United States Department of Energy.
Technical Familiarity for Risk Assessment: working knowledge of security controls, audit logs, and risk implications associated with enterprise systems.
Enterprise Infrastructure: Windows/Linux operating systems, Active Directory, and Group Policy Objects (GPOs).
Security Operations & Engineering: SIEM platforms, Network Intrusion Detection Systems (IDS), host‑based antivirus consoles, and Data Loss Prevention (DLP) solutions.
Technical Assessments: review/translation of outputs from advanced cybersecurity tools, vulnerability scanners, penetration tests, malware analysis, and digital forensics into actionable risk decisions.

Nice To Haves

Experience with N3B/LLCC system portfolios and organizational structures.
Prior involvement in POA&M/ATO submission cycles and DOE reporting.
Experience supporting ICS/Operational Technology (OT) systems and enterprise monitoring platforms.

Responsibilities

Serve as Lead ISSO across assigned General Support Systems (GSS), Major Applications (MA), Industrial Control Systems (ICS), and specialty systems.
Support the ISSM by ensuring operational continuity during escalated or delegated ISSM activities, including system‑security leadership, coordination of staff, and implementation of DOE/NNSA cybersecurity mandates.
Provide mentorship and skill development for ISSO, ISSE, and Risk Analyst staff.
Lead development and maintenance of all Assessment & Authorization (A&A) documentation, including SSPs, SARs, Configuration Management Plans (CMPs), Contingency Plans (CPs), Incident Response Plans (IRPs), and Risk Assessment (RA) artifacts.
Support ISSM and ISSO in preparation, review, and timely submission of Regulatory Documentation (RegDocs) deliverables, Plan of Action & Milestones (POA&M) updates, and Authorization to Operate (ATO) packages.
Ensure documentation is consistent with Los Alamos Legacy Clean‑up Contract (LLCC) governance expectations.
Oversee implementation, testing, and verification of NIST SP 800‑53 controls across assigned systems.
Conduct vulnerability management, log review, control testing, and evidence collection.
Elevate critical findings to ISSM, Cybersecurity Manager, and Chief Information Security Officer (CISO), and coordinate mitigations.
Lead risk assessments for cybersecurity findings, system changes, new capabilities, and emerging DOE directives.
Support ISSM, Cybersecurity Manager, and CISO in enterprise risk reporting, compliance tracking, and implementation of organizational governance processes.
Facilitate peer reviews, POA&M / Performance‑Based Incentive (PBI) contributions, and readiness for DOE assessments.
Engage system owners, Subject Matter Experts (SMEs), and technical stakeholders to ensure cybersecurity expectations are clearly understood and implemented.
Provide the ISSM with situational updates on risk posture, compliance status, and emerging issues requiring manager‑level attention.
Support cross‑functional collaboration with Cyber Engineering, ICS security, Governance, Risk & Compliance (GRC), and enterprise monitoring teams.
Ensure continuity of cybersecurity operations when ISSM responsibilities are delegated.
Support leadership in reviewing system posture, data calls, document tracking, ATO milestone tracking, and DOE submissions.
Help balance workloads across ISSO 4–5 staff, ISSE personnel, and Risk Analysts.
Provide timely and accurate analysis for issues requiring AISSM review, including major vulnerabilities, incidents, or compliance risks.
Support ISSM during coordination with EM‑LA, EM‑HQ, or other DOE/NNSA entities.