Senior Information Systems Security Officer (ISSO)

SAIC•Newington, VA

7h•Onsite

About The Position

SAIC is seeking a Senior Information Systems Security Officer (ISSO) to support cybersecurity and compliance activities for mission-critical IT systems on the MAJESTIC Joint Program Office (JPO) Team. The role implements, manages, and assesses system security controls to ensure compliance with government regulations, standards, and best practices, including NIST 800-53, the Risk Management Framework (RMF), and other federal security policies. The ISSO works with system owners, administrators, and cross-functional security teams to assess risk, maintain security posture, and protect the confidentiality, integrity, and availability of mission-supporting information systems. The position supports on-premises enterprise IT environments, including virtualized Windows servers, MS SQL Server databases, and networking layers. All work is conducted on-site in Springfield, Virginia. This is a subcontractor role; responsibilities and compensation vary based on the subcontract agreement, with competitive salary aligned to market rates and role-specific requirements.

Requirements

Bachelor’s degree.
Satisfy Navy COOL 722 (Information Systems Security Manager) requirements through one or more qualifying certifications, or through a bachelor’s degree in Cybersecurity, Computer Science, IT, or a related field.
2–5 years of professional experience managing and supporting enterprise-level IT environments.
Deep understanding of security frameworks, including NIST 800-53, RMF, and/or DoD 8510.01.
Experience developing and maintaining SSPs and managing POA&Ms for compliance and audit purposes.
Proficiency with vulnerability scanning tools and security analysis platforms such as Nessus, ACAS, or Qualys.
Knowledge of security control implementation and system hardening using DISA STIGs or CIS Benchmarks for platforms and network-enabled devices.
Familiarity with monitoring tools such as Splunk, SolarWinds, or other SIEM solutions for security monitoring and incident management.
Strong understanding of Windows Server and Active Directory security, including account policy configuration and group policy enforcement.
Basic knowledge of Red Hat Enterprise Linux (RHEL) security configurations and patching.
General understanding of networking concepts, security configurations, and protocols, including TCP/IP, VLANs, IPsec, and firewalls.
Ability to conduct risk assessments, analyze vulnerabilities, and make actionable recommendations to remediate threats.
Strong analytical and technical writing skills for security documentation, incident reports, and audit artifacts.
Active TS/SCI clearance and ability to obtain and maintain TS/SCI with Poly.
Must be a U.S. citizen.

Nice To Haves

CISSP or equivalent advanced certifications.
Knowledge of continuous monitoring tools and automated compliance tracking systems.
Familiarity with encryption standards, PKI infrastructures, and secure key management practices.
Hands-on experience with virtualized environments and hyper-converged platforms such as VMware or Nutanix.
Familiarity with ITIL v4 frameworks for managing IT operations and processes.

Responsibilities

Ensure RMF compliance by developing, maintaining, and assessing System Security Plans (SSPs), Plans of Action and Milestones (POA&Ms), policies, and procedures.
Implement and validate security controls in alignment with NIST 800-53, applicable overlays, and system-specific requirements.
Support the Accreditation and Authorization (A&A) process, including documentation and achieving and maintaining system Authority to Operate (ATO) status.
Conduct risk assessments and vulnerability analyses, identify threats and weaknesses, and recommend mitigations.
Work with IT teams to harden platforms, applications, and networks in accordance with DISA STIGs and cybersecurity best practices.
Continuously monitor systems using tools such as Splunk, ACAS, or SolarWinds to support threat detection, event notifications, and security compliance validation.
Collaborate with system administrators, developers, ISSMs, and other teams to address security risks, vulnerabilities, and incidents.
Support incident response through forensic analysis, reporting, and coordination of security-event remediation and recovery.
Provide cybersecurity awareness training to users and team members.
Prepare and deliver security status updates, risk reports, and briefings to senior stakeholders and leadership.
Develop and maintain system documentation, including control implementation descriptions, policies, and standard operating procedures.