Information System Security Officer (ISSO) / RMF Analyst

Role overview Maintain the cybersecurity authorization posture of assigned information systems in federal or defense environments. The role combines Risk Management Framework (RMF) documentation, authorization package coordination, continuous monitoring, and remediation tracking, working with security, engineering, operations, and system stakeholders.

Responsibilities - Create and maintain System Security Plans (SSPs) for assigned systems. - Coordinate Authorization to Operate (ATO) submissions and keep authorization records current using eMASS. - Track Plans of Action and Milestones (POA&Ms) from discovery through remediation and closure. - Carry out continuous monitoring and assess whether security controls are implemented and effective. - Prepare Security Assessment Plans and coordinate Security Assessment Report activities. - Track authorization status and compliance measures, and contribute to supply chain risk documentation and RMF governance planning.

Requirements - Active Secret or Top Secret clearance and compliance with DoD 8140 interim education requirements. - 3–5 years supporting RMF, ATO, or cybersecurity compliance in a DoD or federal setting. - Hands-on experience with eMASS and independent development of SSPs. - Working knowledge of NIST SP 800-53 Rev. 5, DoD RMF, and continuous monitoring. - Demonstrated ability to manage POA&Ms through remediation and closure. - Strong analytical, organizational, and communication skills for working with technical and non-technical partners.

Nice to have - Experience with RMF automation tools, cloud or hybrid authorization boundaries, or large enterprise security programs. - Familiarity with DoD RMF guidance, supply chain risk management, and cross-functional cybersecurity work. - A relevant bachelor’s degree, a DoD 8140 basic-tier credential, or an intermediate-tier certification such as Security+, Cloud+, GCIH, or GSEC.