Senior Information System Security Officer

Job Summary

The Information System Security Officer (ISSO), in collaboration with the Information System Security Manager (ISSM) serves as one of the stewards of the organization’s classified and high-side information systems, ensuring a resilient security posture while enabling mission-critical operations. This role applies deep expertise in information security compliance, secure administration, operations, and data analysis to protect on-premises networks, standalone systems, custom business applications, and peripherals. Responsibilities include hands-on execution of security procedures, continuous monitoring, and collaborative customer support for classified systems in accordance with DoD and DCSA standards. The ISSO executes Risk Management Framework (RMF) activities and pursues Authorization to Operate (ATO) via eMASS and its associated processes, partnering closely with industrial security teams to integrate technical, administrative, and operational controls. Success in this position is demonstrated by a proven record of processing ATO packages supporting the DoD, possession of basic system administration experience, security compliance and technical acumen, clear interpersonal communication, and creative problem solving to balance rigorous security controls with operational effectiveness in support of on-site personnel and mission objectives. This position is a full-time, on-site opportunity which entails face-to-face interactions with various cross-functional teams and colleagues.

Job Responsibilities

Cybersecurity Governance, Risk, and Compliance:

• Serve as the ISSO under ISSM direction, overseeing compliance and secure operations across the lifecycle of classified systems in alignment with DCSA and federal standards
• Advise the Site Facility Security Officer (FSO) and ISSM on classified system security matters and liaise with the local DCSA ISSP
• Ensure compliance with NISP, DoD, and DCSA requirements by executing local policies, processes, and procedures aligned with the DAAG
• Execute RMF steps and maintain required documentation and artifacts, including policies, procedures, training materials, security control implementation, system diagrams, asset inventories, and POA&Ms
• Maintain and renew ATOs for classified systems in alignment with DoD, DCSA, and company requirements
• Collaborate with the DCSA ISSP and internal stakeholders to resolve assessment findings and strengthen security posture and compliance
• Conduct periodic self-inspections and security assessments of classified systems and ensure timely corrective action
• Support internal and external audits by updating documentation, validating configurations, preparing artifacts, and ensuring NIST controls remain compliant
• Identify, document, and mitigate local threats and vulnerabilities to classified systems and ensure timely remediation
• Support the ISSM in delivering site-wide security education and awareness for classified system users
• Assist with investigations of security violations involving classified systems and ensure corrective actions are documented and implemented
• Collaborate with program management, facilities, HR, IT, and other stakeholders to execute security deliverables and support personnel needs
• Perform vulnerability scanning with approved tools (e.g., Nessus), analyze results, assess risk, and develop mitigations within required timelines

Security Administration and Operations:

• Ensure regular data backups, troubleshoot issues, and maintain the health and availability of virtual and physical storage systems
• Install and configure patches, firmware, and software updates for servers and related hardware to maintain security, compliance, and performance
• Serve as a designated Data Transfer Agent (DTA) to move authorized data across classification environments
• Provide on-site technical support using multi-tiered troubleshooting to resolve moderately complex system and application issues
• Monitor and enforce access controls for cleared systems supporting classified programs in accordance with least privilege
• Administer end-user accounts through onboarding, role changes, and offboarding in compliance with authorization protocols
• Conduct scheduled internal