Senior Information System Security Officer (ISSO)

ASRC Federal•Aberdeen Proving Ground, MD

5d•$97,000 - $150,000•Onsite

About The Position

ASRC Federal Technology Solutions LLC is seeking an experienced Information System Security Officer to support DEVCOM-CBC G-6 at Aberdeen Proving Ground, Maryland, or White Sands Missile Range, New Mexico. The role supports development, implementation, and maintenance of cybersecurity policies, standards, and procedures, ensuring compliance with applicable Department of Defense, Army, and DEVCOM CBC regulations. It provides cybersecurity support to the DEVCOM-CBC G-6 Cybersecurity Branch, with a focus on Risk Management Framework (RMF) activities, cybersecurity assessments, incident response, and compliance and account management across unclassified, classified, and standalone systems. An active Top Secret clearance is required; an interim Top Secret clearance is acceptable while the full clearance is granted. The position primarily operates in a professional office environment and involves extended computer use, with occasional movement between buildings on the installation to support users and coordinate with government staff. Some work may involve classified facilities and systems. Work hours are in the Mountain Time Zone, with availability to work until 4 p.m. MST or 6 p.m. EST. Reasonable accommodations may be made for individuals with disabilities to perform essential functions.

Requirements

Bachelor’s degree in Computer Science, Information Technology, Engineering, or a related field, or four additional years of experience in lieu of the degree; the posting also specifies a total of nine years of experience when substituting experience for the degree.
At least five years of hands-on RMF eMASS authorization duties.
Working knowledge of DoD and Army cybersecurity regulations, including Army Regulation 25-2, DoD 8140, and DoD RMF policy.
Experience with Active Directory account management and STIG/SRG audit processes.
Familiarity with the Army Account Validation System (AVS) or an equivalent DoD workforce compliance tracking platform.
Active Top Secret clearance; an interim Top Secret clearance is acceptable until the full clearance is granted.
DoDI 8140.03 qualification for DCWF Work Role Information Systems Security Manager (722 Intermediate). Accepted foundational qualifications include certifications mapped to Work Role 722 Intermediate in the current DoD 8140 Qualification Matrix, such as SecurityX, CASP+, CCISO, CCSP, CISSO, Cloud+, Security+, and SSCP.
Ability to work in Mountain Time Zone hours until 4 p.m. MST or 6 p.m. EST.
Ability to use computer equipment for extended periods and move between installation buildings as needed.

Nice To Haves

Direct experience with eMASS, POA&M, and RMF processes and responsibilities.
Experience serving as an Enhanced Trusted Agent for PKI hardware token issuance.
Experience performing Software Assurance or Hardware Assurance reviews for DoD networks.
Familiarity with NSA and Army data sanitization and destruction policy.
Experience coordinating Negligent Disclosure of Classified Information or classified spill incident response.
CISSP, CASP+, or CISM certification.
Experience supporting DEVCOM or Army G-6 cybersecurity programs.
Preferred certifications listed in the posting: CISSP, SecurityX, and SSCP.

Responsibilities

Maintain current Authority to Operate (ATO) status for DEVCOM systems and provide RMF guidance and support to other ACC locations with similar systems.
Develop, update, and maintain system-level artifacts, such as TTPs, plans, policies, procedures, hardware and software lists, data flows, system architecture diagrams, PIAs, Ports/Protocols/Services, and MOAs/MOUs; associate them with corresponding controls in eMASS.
Obtain, run, analyze, and import required vulnerability scans and compliance checks, including STIGs and Nessus/ACAS scans.
Track and report IAVAs related to DEVCOM systems.
Create, modify, and maintain implementation plans and test results in accordance with DoD, Army, NETCOM, and DEVCOM requirements.
Manage POA&Ms, including their development, status updates, milestone tracking, and closure.
Manage assigned network packages within eMASS and maintain accurate, current authorization documentation.
Create, modify, and maintain all aspects of continuous monitoring (CONMON).
Use existing or develop custom solutions to support RMF requirements, reduce timelines, and provide current compliance status reporting.
Update and track cybersecurity test results, implementation plans, and risk assessments.
Evaluate STIG checklists and document compliance status, deficiencies, and remediation actions.
Coordinate first response to Negligent Disclosure of Classified Information incidents in accordance with organizational incident-response SOPs.
Perform vulnerability management, including identifying vulnerabilities, tracking them, and coordinating corrective actions.