Senior Information Systems Security Officer (ISSO)

SAIC•Springfield, VA

5h•Onsite

About The Position

SAIC is seeking a Senior Information Systems Security Officer (ISSO) to support cybersecurity and compliance activities for mission-critical IT systems on the MAJESTIC Joint Program Office (JPO) Team. The ISSO implements, manages, and assesses system security controls to ensure compliance with government regulations, standards, and best practices, including NIST 800-53, the Risk Management Framework (RMF), and other federal security policies. The role works with system owners, administrators, and cross-functional security teams to assess risks, maintain security postures, and protect the confidentiality, integrity, and availability of mission-supporting information systems. The position supports on-premises enterprise IT environments, including virtualized Windows servers, MS SQL Server databases, and networking layers. All work is conducted on-site in Springfield, Virginia. The role is a subcontractor position; responsibilities and compensation vary based on the subcontract agreement. The stated target salary range is $80,001–$120,000, with the estimate depending on experience and other factors.

Requirements

Bachelor’s degree.
Satisfy Navy COOL 722 (Information Systems Security Manager) requirements through one or more of the listed qualifying certifications, or through a bachelor’s degree in Cybersecurity, Computer Science, IT, or a related field.
Two to five years of professional experience managing and supporting enterprise-level IT environments.
Deep understanding of security frameworks, including NIST 800-53, RMF, and/or DoD 8510.01.
Experience developing and maintaining SSPs and managing POA&Ms for compliance and audit purposes.
Proficiency with vulnerability scanning tools and security analysis platforms such as Nessus, ACAS, or Qualys.
Knowledge of implementing security controls and hardening systems using DISA STIGs or CIS Benchmarks for platforms and network-enabled devices.
Familiarity with Splunk, SolarWinds, or other SIEM solutions for security monitoring and incident management.
Strong understanding of Windows Server and Active Directory security, including account policy configuration and Group Policy enforcement.
Basic knowledge of Red Hat Enterprise Linux (RHEL) security configurations and patching.
General understanding of networking concepts, security configurations, and protocols, including TCP/IP, VLANs, IPsec, and firewalls.
Ability to conduct risk assessments, analyze vulnerabilities, and recommend actionable threat remediation.
Strong analytical and technical writing skills for security documentation, incident reports, and audit artifacts.
Active TS/SCI clearance and ability to obtain and maintain TS/SCI with Poly.
Must be a U.S. citizen.

Nice To Haves

CISSP or equivalent advanced certification, in addition to the CWF requirements.
Knowledge of continuous monitoring tools and automated compliance tracking systems.
Familiarity with encryption standards, PKI infrastructures, and secure key management practices.
Hands-on experience with virtualized environments and hyper-converged platforms such as VMware or Nutanix.
Familiarity with ITIL v4 frameworks for managing IT operations and processes.

Responsibilities

Ensure compliance with RMF requirements by developing, maintaining, and assessing system security artifacts, including System Security Plans (SSPs), POA&Ms, policies, and procedures.
Implement and validate security controls aligned with NIST 800-53, applicable overlays, and system-specific requirements.
Support the Accreditation and Authorization (A&A) process, including preparing documentation and achieving and maintaining system Authority to Operate (ATO) status.
Conduct risk assessments and vulnerability analyses, identify potential threats and weaknesses, and recommend mitigations.
Work with IT teams to harden platforms, applications, and networks in compliance with DISA STIGs and cybersecurity best practices.
Perform continuous system monitoring using tools such as Splunk, ACAS, or SolarWinds to support threat detection, event notifications, and security compliance validation.
Collaborate with system administrators, developers, ISSMs, and other cross-functional teams to address security risks, vulnerabilities, and incidents.
Support incident response through forensic analysis, reporting, and coordination of remediation and recovery efforts.
Provide cybersecurity awareness training to users and team members.
Prepare and deliver security status updates, risk reports, and briefings to senior stakeholders and leadership.
Develop and maintain system documentation, including security control implementation descriptions, policies, and standard operating procedures.