Senior Information System Security Officer (ISSO)

KBR•Colorado Springs, CO

8d•$110,000 - $147,000

About The Position

The Senior Information System Security Officer supports the security, compliance, and authorization of control systems and their connected IT components. The role maintains system security configurations and baselines, supports risk assessments, addresses security deficiencies, and helps ensure continued system performance and availability. The position works with technology teams and stakeholders to identify security risks, select and implement protective solutions, and maintain vulnerability tracking and remediation documentation. It also develops and carries out security control assessment procedures and supports ongoing monitoring, RMF authorization, and compliance through security documentation and authorization packages. The role is with KBR’s Mission Technology Solutions business, which is planned to spin off as Trinzic in January 2027. Employees who join the business before the spin-off are expected to transition to Trinzic when the separation is complete without reapplying.

Requirements

Active TS/SCI clearance.
DoDD 8140.01 certification compliance, such as Security+, GSEC, SSCP, CISSP, or similar.
At least 5 years of related experience.
Working knowledge of DoD RMF Revision 4 and/or 5, cyber technologies, NIST standards, and DISA STIG governance.
Analytical, communication, and technical documentation skills to assess compliance, evaluate vulnerabilities, and collaborate across complex organizational relationships.
Ability to work effectively in a small-team environment, support varied responsibilities, and contribute beyond primary job duties to meet team objectives.

Nice To Haves

Bachelor’s degree in IT or a cybersecurity-related field, or equivalent related experience.
Experience with RMF controls, eMASS or XACTA, risk assessment, Plans of Action and Milestones (POAMs), policy and plans documentation, Information Assurance Vulnerability Management (IAVM), and vulnerability assessment for mission systems.

Responsibilities

Apply updates, patches, and security technical implementations while maintaining control system performance and availability requirements.
Establish and maintain security configuration baselines for control systems, including IT components, interconnections, and interfaces.
Maintain knowledge of control system and IT technologies and their security functions.
Support risk assessments by reviewing and documenting the implementation status of control system security requirements.
Mitigate or correct security deficiencies identified during security or certification testing, or recommend risk acceptance to the appropriate senior leader or authorized representative.
Review and define requirements for information security solutions, controls compliance, and policy development.
Partner with tools and technology teams to troubleshoot, develop, select, implement, and automate security solutions that protect system data from internal and external threats.
Identify and communicate security risks, recommend mitigating controls, and maintain POA&M documentation for vulnerability tracking and remediation.
Develop and execute security control assessment procedures to verify conformance with control requirements during continuous monitoring and authorization assessments.
Ensure configuration management policies and procedures for authorizing hardware and software use are followed, and coordinate system baseline changes with appropriate stakeholders before implementation.
Conduct control system asset management, vulnerability assessments, and remediation support through inventory maintenance, security scanning, and reporting.
Support RMF authorization and compliance through development, maintenance, and assessment of security documentation, body-of-evidence artifacts, and system authorization packages using eMASS, XACTA, or equivalent tools.