IT Security & Risk Analyst II

Oceaneering•Chesapeake, VA

About The Position

The Information System Security Officer (ISSO) is responsible for the implementation, management, and oversight of cybersecurity controls for classified information systems under Defense Counterintelligence and Security Agency (DCSA) governance. The ISSO ensures systems comply with federal and DoD cybersecurity requirements, supports system accreditation, and maintains the security posture of assigned environments throughout their lifecycle.

Requirements

Bachelor’s degree in Cybersecurity, Information Technology, Computer Science, or a related field (or equivalent experience).
3–5+ years of experience in cybersecurity, information assurance, or classified system security operations.
Hands-on experience supporting DoD RMF, NIST SP 800‑53 security controls, and DCSA (DAAPM) compliance requirements.
Working knowledge of classified information systems, enclave security, and federal cybersecurity regulations (e.g., DoDI 8500.01, DoDI 8510.01).
Experience developing and maintaining accreditation artifacts such as System Security Plans (SSPs), POA&Ms, and Continuous Monitoring documentation.
Ability to perform vulnerability scanning, configuration management, audit log review, and security assessments.
Familiarity with tools such as ACAS, Nessus, SCCM, SIEM platforms, and other cybersecurity monitoring technologies.
Active DoD security clearance (typically Secret; some roles require TS/SCI).
IAM Level II certification required (e.g., CAP, CASP+, CISM, GSLC) in accordance with DoD 8140/8570.

Nice To Haves

Experience supporting DCSA inspections, audits, and security reviews.
Knowledge of classified system provisioning, account management, and secure enclave operations.
Background with STIGs, HBSS/ESM, secure configuration baselines, patch management processes, and enclave/system hardening.
Experience with incident response procedures for classified environments.
Strong communication skills with the ability to brief leadership and collaborate with system owners, administrators, and security stakeholders.
Familiarity with eMASS or similar compliance management platforms.
Experience supporting system changes, upgrades, or new system integrations with RMF documentation updates.

Responsibilities

Manage and maintain cybersecurity compliance for classified systems in accordance with DoD RMF, NIST SP 800‑53, DCSA Assessment and Authorization Process Manual (DAAPM) (DAAG), and applicable DoD directives.
Develop, update, and maintain System Security Plans (SSPs), POA&Ms, Continuous Monitoring plans, and other accreditation artifacts required by DCSA.
Conduct periodic security reviews, vulnerability scans, and technical assessments; track and remediate identified findings.
Oversee system configuration management, ensuring baseline controls, approved hardware/software listings, and secure configuration standards are enforced.
Coordinate with System Owners, Administrators, Program Managers, and Security leadership to maintain system security, support audits, and implement required changes.
Monitor, document, and report cybersecurity incidents; coordinate responses with security teams and ensure proper escalation and documentation.
Ensure proper account management practices, including user provisioning, access reviews, and enforcement of least privilege and need‑to‑know.
Support DCSA inspections, audits, and assessments by preparing documentation, coordinating interviews, and ensuring system readiness.
Provide security guidance for changes, upgrades, new system integrations, and emerging risks affecting system security posture.
Maintain awareness of evolving DoD/DCSA cybersecurity requirements and advise leadership on necessary updates to policies, controls, and procedures.