Senior Information System Security Officer (ISSO)

ASRC Federal•White Sands Missile Range, NM

3d•Onsite

About The Position

ASRC Federal Technology Solutions LLC is seeking an experienced Information System Security Officer to support DEVCOM-CBC G-6 at Aberdeen Proving Ground, Maryland, or White Sands Missile Range, New Mexico. The role supports the development, implementation, and maintenance of cybersecurity policies, standards, and procedures, ensuring compliance with applicable DoD, Army, and DEVCOM CBC regulations. The position provides cybersecurity support to the DEVCOM-CBC G-6 Cybersecurity Branch, with a focus on Risk Management Framework (RMF) activities, cybersecurity assessments, incident response, and compliance and account management across unclassified, classified, and standalone systems. An active Top Secret clearance is required; an interim Top Secret clearance is acceptable until the full clearance is granted. The position primarily operates in a professional office environment at either listed installation, working within or alongside the DEVCOM-CBC G-6 Cybersecurity Branch. Work hours are in the Mountain Time Zone, and the candidate must be able to work until 4 p.m. MST or 6 p.m. EST. The role involves extended computer use and may require moving between buildings on the installation to support users and coordinate with government staff. Some work may involve access to classified facilities and systems. Reasonable accommodation may be made to enable individuals with disabilities to perform the essential functions of the position.

Requirements

Bachelor’s degree in Computer Science, Information Technology, Engineering, or a related field, or four additional years of experience in lieu of the degree, for a total of nine years.
At least five years of hands-on RMF eMASS authorization duties.
Working knowledge of DoD and Army cybersecurity regulations, including Army Regulation 25-2, DoD 8140, and DoD RMF policy.
Experience with Active Directory account management and STIG/SRG audit processes.
Familiarity with the Army Account Validation System (AVS) or equivalent DoD workforce compliance tracking platforms.
Active Top Secret clearance; an interim Top Secret clearance is acceptable until the full clearance is granted.
DoDI 8140.03 qualification for DCWF Work Role Information Systems Security Manager (722 Intermediate), with a qualification mapped to Work Role 722 Intermediate in the current DoD 8140 Qualification Matrix. Listed examples include SecurityX, CASP+, CCISO, CCSP, CISSO, Cloud+, Security+, and SSCP.
Ability to work until 4 p.m. MST or 6 p.m. EST.

Nice To Haves

Direct experience with eMASS, POA&M, and RMF processes and responsibilities.
Experience serving as an Enhanced Trusted Agent for PKI hardware token issuance.
Experience performing Software Assurance or Hardware Assurance reviews for DoD networks.
Familiarity with NSA and Army data sanitization and destruction policy.
CISSP, CASP+, or CISM certification.
Experience supporting DEVCOM or Army G-6 cybersecurity programs.
Preferred certifications: CISSP, SecurityX, or SSCP.

Responsibilities

Maintain current Authority to Operate (ATO) status for DEVCOM systems and provide RMF guidance and support to other ACC locations with similar systems.
Develop, update, and modify system-level artifacts, including TTPs, plans, policies, procedures, hardware/software lists, data flow documentation, system architecture diagrams, PIAs, Ports/Protocols/Services documentation, and MOAs/MOUs; associate them with corresponding controls in eMASS.
Obtain, run, analyze, and import applicable vulnerability scanners and compliance checkers, including STIGs and Nessus/ACAS scans.
Track and report IAVAs related to DEVCOM systems.
Create, modify, and maintain implementation plans and test results as required by DoD, Army, NETCOM, and DEVCOM.
Manage Plans of Action and Milestones (POA&Ms), including development, status updates, milestone tracking, and closure.
Manage assigned network packages within eMASS and maintain accurate, current authorization documentation.
Create, modify, and maintain all aspects of continuous monitoring (CONMON).
Use existing or develop custom solutions to facilitate RMF requirements, reduce timelines, and provide current compliance status reporting.
Update and track cybersecurity test results, implementation plans, and risk assessments.
Evaluate STIG checklists and document compliance status, deficiencies, and required remediation actions.
Coordinate first response to Negligent Disclosure of Classified Information incidents in accordance with organizational incident-response SOPs.
Conduct vulnerability management activities, including identifying vulnerabilities, tracking them, and coordinating corrective actions.