Senior Information Systems Security Officer (ISSO)

SAIC•Springfield, VA

10d•Onsite

About The Position

SAIC is seeking a motivated and skilled Senior Information Systems Security Officer (ISSO) to support cybersecurity and compliance activities for mission-critical IT systems on the MAJESTIC Joint Program Office (JPO) Team. The ISSO implements, manages, and assesses system security controls to ensure compliance with government regulations, standards, and best practices, including NIST 800-53, the Risk Management Framework (RMF), and other federal security policies. The role works closely with system owners, administrators, and cross-functional security teams to assess risks, maintain security postures, and protect the confidentiality, integrity, and availability of information systems supporting the mission. This is an on-site role in Springfield, Virginia, supporting on-premises enterprise IT environments that include virtualized Windows servers, MS SQL Server databases, and networking layers. This is a subcontractor role; responsibilities and compensation vary based on the subcontract agreement. The posting describes compensation as competitive and aligned with market rates and role-specific requirements.

Requirements

Bachelor’s degree.
Meet Navy COOL 722 (Information Systems Security Manager) requirements through one or more of the listed qualifying certifications, or through a bachelor’s degree in Cybersecurity, Computer Science, IT, or a related field.
2–5 years of professional experience managing and supporting enterprise-level IT environments.
Deep understanding of security frameworks, including NIST 800-53, RMF, and/or DoD 8510.01.
Experience developing and maintaining System Security Plans (SSPs) and managing POA&Ms for compliance and audit purposes.
Proficiency with vulnerability scanning tools and security analysis platforms such as Nessus, ACAS, or Qualys.
Knowledge of security control implementation and system hardening using DISA STIGs or CIS Benchmarks for platforms and network-enabled devices.
Familiarity with monitoring tools such as Splunk, SolarWinds, or other SIEM solutions for security monitoring and incident management.
Strong understanding of Windows Server and Active Directory security, including account policy configuration and group policy enforcement.
Basic knowledge of Red Hat Enterprise Linux (RHEL) security configurations and patching.
General understanding of networking concepts, security configurations, and protocols such as TCP/IP, VLANs, IPsec, and firewalls.
Ability to conduct risk assessments, analyze vulnerabilities, and make actionable recommendations to remediate threats.
Strong analytical and technical writing skills for maintaining security documentation, incident reports, and audit artifacts.
Active TS/SCI clearance and ability to obtain and maintain a TS/SCI with Poly.
Must be a U.S. citizen.

Nice To Haves

CISSP or equivalent advanced certifications, in addition to the CWF requirements.
Knowledge of continuous monitoring tools and automated compliance tracking systems.
Familiarity with encryption standards, PKI infrastructures, and secure key management practices.
Hands-on experience with virtualized environments and hyper-converged platforms such as VMware or Nutanix.
Familiarity with ITIL v4 frameworks for managing IT operations and processes.

Responsibilities

Ensure compliance with RMF requirements by developing, maintaining, and assessing system security artifacts, including SSPs, POA&Ms, policies, and procedures.
Implement and validate security controls in alignment with NIST 800-53, associated overlays, and system-specific requirements.
Support the Accreditation and Authorization (A&A) process, including preparing documentation and achieving and maintaining system Authority to Operate (ATO) status.
Conduct risk assessments and vulnerability analyses, identify potential threats and weaknesses, and recommend mitigations.
Work with IT teams to harden platforms, applications, and networks in compliance with DISA STIGs and cybersecurity best practices.
Perform continuous system monitoring using tools such as Splunk, ACAS, or SolarWinds to support threat detection, event notifications, and security compliance validation.
Collaborate with system administrators, developers, ISSMs, and other cross-functional teams to address security risks, vulnerabilities, and incidents.
Support incident response through forensic analysis, report generation, and coordination of remediation and recovery efforts.
Provide cybersecurity awareness training to users and team members.
Prepare and deliver security status updates, risk reports, and briefings to senior stakeholders and leadership.
Develop and maintain system documentation, including security control implementation descriptions, policies, and standard operating procedures.