Senior Information Systems Security Officer (ISSO) - Classified Environment

Oak Ridge National Laboratory•Oak Ridge, TN

About The Position

Oak Ridge National Laboratory’s Field Intelligence Operations Division within the National Security Sciences Directorate is seeking an Information Systems Security Officer to provide day-to-day security support for Sensitive Compartmented Information (SCI) and Special Access Program (SAP) systems in classified environments. The ISSO works with the Information Systems Security Manager on security assessments and authorizations, implements cybersecurity requirements and procedures, and helps ensure compliance with DOE, Department of War, sponsor, Intelligence Community, and other applicable security policies. The work follows the Risk Management Framework (RMF), the Joint Special Access Program Implementation Guide (JSIG), and Intelligence Community Directive 503 (ICD 503), with a focus on system operations, maintenance, and disposal. The role supports classified computing and infrastructure, including high-performance computing, artificial intelligence, advanced computing platforms, data centers, networks, storage, management systems, and research environments. The ISSO collaborates with engineering teams, program teams, security officials, and mission stakeholders to integrate security into system design and operations, maintain authorization readiness, manage risk, and support mission readiness. The position also provides cybersecurity guidance and training and upholds applicable environmental, safety, and health requirements and ORNL’s values of Impact, Integrity, Teamwork, Safety, and Service. An active TS, Q, or TS/SCI clearance is required for consideration, and the employee must be able to obtain and maintain SAP access and an SCI clearance. This is a WSAP testing-designated position requiring a pre-placement drug test and participation in random drug testing; random polygraph testing may also apply. Visa sponsorship is not available.

Requirements

Bachelor’s degree in information technology or a related technical field and at least eight years of cybersecurity experience, including RMF assessment and authorization; additional experience may be considered in lieu of a degree.
Active TS, Q, or TS/SCI clearance required for consideration.
Ability to obtain and maintain SAP access.
Experience supporting SCI environments.
Security+ or another certification that meets DoD 8140 qualification requirements for the role.
Working knowledge of the RMF process and requirements.
Working knowledge of NIST SP 800-53, CNSSI 1253, ICD-503, and JSIG.
Experience developing, testing, and collecting artifacts for RMF packages and Bodies of Evidence across multiple systems.
Experience performing authorized data transfers across multiple systems and classification levels.
Ability to obtain and maintain an SCI clearance from the Department of Energy.
Pass a pre-placement drug test and participate in ongoing random drug testing; random polygraph testing may also apply.

Nice To Haves

Experience supporting DoW and DOE.
CISSP, CGRC, CompTIA SecurityX, or a comparable advanced security certification.
ISSO or ISSE experience within DOE, DoW, or the Intelligence Community.
Experience applying DoW and Intelligence Community cybersecurity practices to on-premises and cloud-native Kubernetes processing systems.
Experience implementing and assessing DISA Security Technical Implementation Guides and configuration standards.
Hands-on experience operating, maintaining, or assessing a cross-domain solution from the NCDSMO Baseline List.
Working knowledge of NCDSMO Raise the Bar requirements, including lab-based and site-based assessments.
Experience taking a cross-domain solution through a full assessment and authorization cycle, from initial package to ATO.
Working knowledge of audit reduction, vulnerability scanning, compliance checking, and malware analysis tools such as Splunk, Tenable Nessus, ESS, SCAP Compliance Checker, and STIG Viewer.
Experience with Security Directives, Policies, Publications, and Regulations.
Strong written and verbal communication skills, including communication with cognizant security agencies, customers, and senior managers.
Strong organizational skills and ability to work independently with minimal guidance.

Responsibilities

Provide cybersecurity oversight for classified SCI and SAP information systems and ensure compliance with applicable DOE, DoW, Intelligence Community, and NIST requirements.
Lead and coordinate RMF activities, security control implementation, system authorization efforts, and ongoing ATO readiness.
Develop, review, and maintain System Security Plans, authorization documentation, risk assessments, POA&Ms, and compliance artifacts using Xacta and other approved tools.
Work with system engineers, network architects, and program teams to integrate cybersecurity requirements into classified infrastructure design, deployment, modernization, and operations.
Support cybersecurity integration for high-performance computing, artificial intelligence, advanced computing platforms, data centers, and associated networks, storage, management systems, and research environments.
Coordinate vulnerability management, system hardening, DISA STIG compliance, security impact assessments, and continuous monitoring.
Assess security implications of system modifications, emerging technologies, network interconnections, and changing mission requirements, and recommend practical solutions.
Conduct or support system security testing, audit log reviews, annual self-inspections, incident investigations, contingency planning, and corrective actions.
Oversee applicable access control reviews, authorized data transfers, classified media handling, and other operational security procedures.
Partner with the ISSM, Authorizing Official representatives, engineering teams, and mission stakeholders to address authorization requirements, resolve security concerns, and support mission readiness.
Advise program leadership on cybersecurity risks, compliance status, authorization dependencies, and opportunities to improve security processes and operational efficiency.
Provide cybersecurity guidance and training to system administrators, technical personnel, and users.
Uphold applicable environmental, safety, and health requirements and maintain professional and ethical conduct.
Align work with ORNL’s core values and promote equal opportunity and a respectful workplace.