Senior Information Systems Security Officer (ISSO)

SAIC•California, MD

12d•Onsite

About The Position

SAIC is seeking a Senior Information Systems Security Officer (ISSO) to support cybersecurity and compliance activities for mission-critical IT systems on the MAJESTIC Joint Program Office (JPO) Team. The role implements, manages, and assesses system security controls to ensure compliance with government regulations, standards, and best practices, including NIST 800-53, the Risk Management Framework (RMF), and federal security policies. The ISSO works with system owners, administrators, and cross-functional security teams to assess risks, maintain security postures, and protect the confidentiality, integrity, and availability of mission-supporting information systems. The work environment section specifies on-site support in Springfield, VA, and describes support for on-premises enterprise IT environments, including virtualized Windows servers, MS SQL Server databases, and networking layers. The description also states the role is a subcontractor position, with responsibilities and compensation varying by subcontract agreement and a competitive salary aligned to market rates and role-specific requirements.

Requirements

Bachelor’s degree.
Meet Navy COOL 722 (Information Systems Security Manager) CWF requirements through one or more listed qualifying certifications, or through a bachelor’s degree in Cybersecurity, Computer Science, IT, or a related field.
2–5 years of professional experience managing and supporting enterprise-level IT environments.
Deep understanding of security frameworks, including NIST 800-53, RMF, and/or DoD 8510.01.
Experience developing and maintaining SSPs and managing POA&Ms for compliance and audit purposes.
Proficiency with vulnerability scanning tools and security analysis platforms such as Nessus, ACAS, or Qualys.
Knowledge of security control implementation and system hardening using DISA STIGs or CIS Benchmarks for platforms and network-enabled devices.
Familiarity with monitoring tools such as Splunk, SolarWinds, or other SIEM solutions for proactive security monitoring and incident management.
Strong understanding of Windows Server and Active Directory security, including account policy configurations and group policy enforcement.
Basic knowledge of Red Hat Enterprise Linux (RHEL) security configurations and patching.
General understanding of networking concepts, security configurations, and protocols such as TCP/IP, VLANs, IPsec, and firewalls.
Ability to conduct risk assessments, analyze vulnerabilities, and recommend actionable threat remediation.
Strong analytical and technical writing skills for security documentation, incident reports, and audit artifacts.
Active TS/SCI clearance and ability to obtain and maintain a TS/SCI with Poly.
Must be a U.S. citizen.

Nice To Haves

CISSP or equivalent advanced certifications, in addition to CWF requirements.
Knowledge of continuous monitoring tools and automated compliance tracking systems.
Familiarity with encryption standards, PKI infrastructures, and secure key management practices.
Hands-on experience with virtualized environments and hyper-converged platforms such as VMware or Nutanix.
Familiarity with ITIL v4 frameworks for managing IT operations and processes.

Responsibilities

Ensure compliance with RMF requirements by developing, maintaining, and assessing System Security Plans (SSPs), POA&Ms, policies, and procedures.
Implement and validate security controls in alignment with NIST 800-53, associated overlays, and system-specific requirements.
Support the Accreditation and Authorization (A&A) process, including preparing documentation and achieving and maintaining system Authority to Operate (ATO) status.
Conduct risk assessments and vulnerability analyses; identify threats and weaknesses and recommend mitigations.
Work with IT teams to implement system hardening for platforms, applications, and networks in compliance with DISA STIGs and cybersecurity best practices.
Perform continuous system monitoring using tools such as Splunk, ACAS, or SolarWinds for threat detection, event notifications, and security compliance validation.
Collaborate with system administrators, developers, ISSMs, and other cross-functional teams to address security risks, vulnerabilities, and incidents.
Support incident response through forensic analysis, report generation, and coordination of remediation and recovery efforts.
Provide cybersecurity awareness training to users and team members.
Prepare and deliver security status updates, risk reports, and briefings to senior stakeholders and leadership.