Info System Security Officer (ISSO)

Overview

AMERICAN SYSTEMS is an employee-owned federal government contractor supporting national priority programs through our strategic solutions in the areas of Information Technology, Test & Evaluation, Program Mission Support, Engineering & Analysis, and Training. We are seeking an Information System Security Officer (ISSO) to support a Network Operations Center Network Management Support Services. The ISSO will serve as a designated security professional for one or more FISMA systems of record and new information systems, supporting the Assessment and Authorization (A&A) lifecycle, Authority to Operate (ATO) activities, ongoing authorization, continuous monitoring, vulnerability management, and compliance with government security requirements. This role will work closely with the Government Program Manager, Technical POC/Task Manager, Information Systems Security Manager (ISSM), COR, system owners, engineers, and security stakeholders.

Responsibilities

• Perform ISSO duties in accordance with DHS 4300A, HB 1400-05D, FISMA guidance, applicable NIST publications, and approved program SOPs.

• Lead or support the Assessment and Authorization (A&A), reaccreditation, and continuous-monitoring processes for assigned information systems.

• Notify security leadership of upcoming accreditation or reaccreditation requirements and coordinate reaccreditation kickoff activities with the agency's Security Authorization Team.

• Support the transition of designated systems to Ongoing Authorization (OA), also known as continuous monitoring.

• Manage Plans of Action and Milestones (POA&Ms), including development, documentation, SME follow-up, remediation tracking, and status reporting.

• Review Information Security Vulnerability Management (ISVM) messages, determine applicability, acknowledge notifications, track remediation, and coordinate POA&M creation for unresolved vulnerabilities.

• Review weekly network scans and log information; prepare vulnerability summaries and identify critical and high-risk issues affecting assigned systems.

• Maintain accurate system asset inventories and provide updates to the Vulnerability Assessment Team (VAT); reconcile system inventories with DHS detailed asset reports.

• Review proposed change requests to verify that changes comply with security standards and update asset records and System Security Plans (SSPs) when systems or configurations change.

• Develop, review, maintain, and submit A&A and security documentation for Government approval, including SSPs, risk assessments, FIPS 199 categorization assessments, ST&E plans and results, ATO and ATT artifacts, contingency plans, ISAs, waivers, and POA&Ms.

• Review and update SSPs annually or when significant system changes occur; complete annual NIST SP 800-26 or NIST SP 800-53 assessments as required.

• Prepare documentation and support the annual Ongoing Authorization Review Management Board (OARMB), DHS/CISA/OMB audits, cybersecurity data calls, and FedRAMP or cloud-as-a-service activities, as applicable.

• Assist the Computer Security Incident Response Center (CSIRC) with investigations of security violations and incidents.

• Support encryption and security compliance requirements, including FIPS 197 AES-256, FIPS 140-2 validated cryptographic modules, NSA Type 1 or

• Type 2 encryption, PKI, and emerging FIPS 203, 204, and 205 requirements.

• Prepare weekly ISSO reports covering ATO activities, assessments, audits, change requests, POA&Ms, ISVMs, waivers, compliance highlights, and issues requiring management guidance.

Qualifications

• Senior ISSO candidates should demonstrate approximately 5–10 years of relevant information systems security, cybersecurity, or security authorization experience. Candidates supporting junior-level ISSO assignments.

• In-depth knowledge of the Risk Management Framework (RMF), NIST publications, FISMA, DHS 4300A, and HB 1400-05D.

• Assessment and Authorization: Demonstrated experience implementing or assessing NIST SP 800-53 controls and supporting A&A, ATO, reaccreditation, or continuous-monitoring activities.

• Experience reviewing Nessus or comparable vulnerability scans, tracking ISVMs, managing remediation, and developing or maintaining POA&Ms in an enterprise environment.

• Experience preparing or maintaining SSPs, security assessments, risk assessments, contingency plans, ST&E artifacts, ATO packages, waivers, and related security documentation.

• Understanding of enterprise networking concepts, infrastructure, architectures, and configuration changes.

• Ability to work effectively in a team environment, build rapport with Government and customer organizations, and communicate technical security issues clearly.

• Education: Bachelor’s degree in cybersecurity, information assurance, computer science, information systems, or a related field is preferred; equivalent relevant experience may be considered.

• Preferred Qualifications

• Experience supporting a federal or other mission-critical enterprise network operations environment.

• Security Clearance

• Ability to obtain Public Trust, Preferred Secret/Top Secret Clearance

• Certifications

• CISSP, Security+, Network+, CISA, CAP, or security auditing certification recommended.

Pay Transparency Statement

AMERICAN SYSTEMS is committed to pay transparency for our applicants and employee-owners. The salary range for this position is USD $110,800.00/Yr. - USD $185,100.00/Yr. Actual compensation will be determined based on several factors permitted by law. AMERICAN SYSTEMS provides for the welfare of its employees and their dependents through a comprehensive benefits program by offering healthcare benefits, paid leave, retirement plans, insurance programs, and education and training assistance.

EEO Statement

EEO Race/Sex/Disability Status/Veteran Status