Senior Information Systems Security Officer (ISSO)

SAIC•California, MD

6h•Onsite

About The Position

SAIC is seeking a Senior Information Systems Security Officer to support cybersecurity and compliance activities for mission-critical IT systems on the MAJESTIC Joint Program Office (JPO) Team. The role implements, manages, and assesses system security controls to ensure compliance with government regulations, standards, and best practices, including NIST 800-53, the Risk Management Framework (RMF), and other federal security policies. The ISSO works with system owners, administrators, and cross-functional security teams to assess risk, maintain security postures, and protect the confidentiality, integrity, and availability of information systems supporting the mission. The position supports on-premises enterprise IT environments, including virtualized Windows servers, MS SQL Server databases, and networking layers. The description gives conflicting on-site locations: the opening says Port Hueneme, California, while the Work Environment and Notes section says Springfield, Virginia. It also identifies the role as a subcontractor position, with responsibilities and compensation varying by subcontract agreement and competitive salary aligned to market rates and role-specific requirements.

Requirements

Bachelor’s degree. The listed CWF requirement may also be met through a bachelor’s degree in Cybersecurity, Computer Science, IT, or a related field.
Satisfy Navy COOL 722 (Information Systems Security Manager) requirements through one or more qualifying certifications, or through the stated qualifying bachelor’s degree pathway.
2–5 years of professional experience managing and supporting enterprise-level IT environments.
Deep understanding of security frameworks, including NIST 800-53, RMF, and/or DoD 8510.01.
Experience developing and maintaining SSPs and managing POA&Ms for compliance and audit purposes.
Proficiency with vulnerability scanning and security analysis tools such as Nessus, ACAS, or Qualys.
Knowledge of implementing security controls and hardening systems using DISA STIGs or CIS Benchmarks for platforms and network-enabled devices.
Familiarity with monitoring tools such as Splunk, SolarWinds, or other SIEM solutions for security monitoring and incident management.
Strong understanding of Windows Server and Active Directory security, including account policy configurations and group policy enforcement.
Basic knowledge of Red Hat Enterprise Linux (RHEL) security configurations and patching.
General understanding of networking concepts, security configurations, and protocols such as TCP/IP, VLANs, IPsec, and firewalls.
Ability to conduct risk assessments, analyze vulnerabilities, and make actionable recommendations to remediate threats.
Strong analytical and technical writing skills for security documentation, incident reports, and audit artifacts.
Active TS/SCI clearance and ability to obtain and maintain TS/SCI with Poly.
Must be a U.S. citizen.

Nice To Haves

CISSP or equivalent advanced certifications, in addition to the CWF requirements.
Knowledge of continuous monitoring tools and automated compliance tracking systems.
Familiarity with encryption standards, PKI infrastructures, and secure key management practices.
Hands-on experience with virtualized environments and hyper-converged platforms such as VMware or Nutanix.
Familiarity with ITIL v4 frameworks for managing IT operations and processes.

Responsibilities

Ensure compliance with RMF requirements by developing, maintaining, and assessing system security artifacts, including System Security Plans (SSPs), POA&Ms, policies, and procedures.
Implement and validate security controls aligned with NIST 800-53, associated overlays, and system-specific requirements.
Support the Accreditation and Authorization (A&A) process, including preparing documentation and achieving and maintaining system Authority to Operate (ATO) status.
Conduct risk assessments and vulnerability analyses, identify threats and weaknesses, and recommend mitigation actions.
Work with IT teams to harden platforms, applications, and networks in compliance with DISA STIGs and cybersecurity best practices.
Perform continuous system monitoring using tools such as Splunk, ACAS, or SolarWinds to support threat detection, event notifications, and security compliance validation.
Collaborate with system administrators, developers, ISSMs, and other cross-functional teams to address security risks, vulnerabilities, and incidents.
Support incident response through forensic analysis, report generation, and coordination of security-event remediation and recovery.
Provide cybersecurity awareness training to users and team members.
Prepare and deliver security status updates, risk reports, and briefings to senior stakeholders and leadership.