Information System Security Officer

Job Summary

Job Description

Woods Hole Oceanographic Institution is searching for a highly skilled and cleared Information System Security Officer (ISSO) / Classified Systems Information Assurance Analyst to join our team, focusing exclusively on the security of classified information systems and networks. This critical role is responsible for ensuring the confidentiality, integrity, and availability of sensitive government information in accordance with stringent U.S. government (USG) security directives.

The ISSO will be instrumental in the authorization and accreditation(A&A) process, continuous monitoring, incident response, and the implementation of robust security controls for classified environments. The ideal candidate will possess a deep understanding of relevant security frameworks, policies, and a proven track record of maintaining secure classified systems. This is a regular, full-time, exempt position, and is eligible for full benefits.

ESSENTIAL FUNCTIONS

Authorization & Accreditation (A&A) / Risk Management Framework (RMF): 

• Lead or support the development, review, and submission of comprehensive security authorization packages (e.g., System Security Plans (SSPs), Risk Assessment Reports, Contingency Plans, Plan of Action and Milestones (POA&Ms)) for classified systems. 

• Ensure all classified systems maintain an Authority to Operate (ATO), Interim Authority to Test (IATT), or Authority to Connect (ATC) in accordance with RMF or legacy A&A processes (e.g., DIACAP). 

• Interpret and apply USG security policies, regulations, and guidelines, including but not limited to: NISPOM, DoD Instruction 8500.01, NIST SP 800-53, DCID 6/3, ICD 503, JSIG, and DISA STIGs. 

Security Control Implementation & Enforcement: 

• Design, implement, and maintain security controls specific to classified systems, including secure configurations, access controls, auditing, media control, and classified spillage prevention/response. 

• Configure and manage specialized security tools relevant to classified environments (e.g., Assured Compliance Assessment Solution (ACAS), Host Based Security System (HBSS), Data Loss Prevention (DLP) solutions). 

• Perform rigorous hardening of operating systems (Windows, Linux), applications, and network devices based on DISA Security Technical Implementation Guides (STIGs) and Security Requirements Guides (SRGs). 

Vulnerability Management & Continuous Monitoring: 

• Conduct vulnerability scans, analyze results, and work with system administrators to remediate security weaknesses on classified systems. 

• Oversee and perform continuous monitoring activities, including reviewing audit logs, security events, and system alerts for anomalous behavior. 

• Track and ensure compliance with Information Assurance Vulnerability Management (IAVM) directives.

Incident Response & Classified Spillage: 

• Act as a primary point of contact and lead for security incidents and classified spillage events on assigned systems. 

• Execute incident response procedures, including containment, eradication, recovery, and detailed reporting to relevant government authorities. 

• Participate in forensic investigations as required for classified incidents.

Compliance & Audit Support: 

• Maintain meticulous documentation of all security artifacts, configurations, policies, and procedures for classified systems. 

• Support internal and external security inspections, audits, and assessments by government agencies (e.g., DCSA, DSS, NSA). 

• Develop and implement standard operating procedures (SOPs) for the secure operation of classified systems. 

User Training & Guidance: 

• Provide guidance and training to users on proper handling, marking, and safeguarding of classified information and operation of classified systems. 

• Ensure all personnel accessing classified systems meet training requirements (e.g., security awareness, insider threat). 

Configuration Management: 

• Manage and control changes to the hardware, software, and firmware of classified systems to maintain their security posture and accreditation. 

MINIMUM QUALIFICATIONS

Security Clearance: 

• Active U.S. Government Security Clearance required at the SECRET level or above.

Education:

• Bachelor's degree in Computer Science, Information Security, Cybersecurity, or equivalent