Information Systems Security Officer (ISSO)

Role overview

Maintain security authorization and continuous monitoring for systems operating in U.S. Department of Defense impact level 4 and 5 environments. You’ll manage risk management framework activities and evidence, keep authorization packages ready for assessment, and work with engineering to translate security requirements into practical controls for cloud-based systems. The role serves as a technical partner to security leaders, assessors, and authorizing officials.

Responsibilities

- Carry out the DoD risk management framework lifecycle, from system categorization and control implementation through authorization and ongoing monitoring. - Maintain authorization packages in eMASS, including control narratives, test results, supporting evidence, and monitoring status. - Manage ports, protocols, and services registrations, reconciling documented data flows with system boundaries. - Write and update system security plans, plans of action and milestones, and other assessment artifacts. - Coordinate vulnerability, patch, and continuous monitoring work; track findings and remediation with engineering. - Review security configurations and scan results, and represent the technical security posture during assessments and audits. - Map cloud, container, Kubernetes, and CI/CD controls to applicable security requirements and provide defensible evidence.

Requirements

- Three to five years of hands-on DoD cybersecurity, authorization, or information assurance experience, including support for authorization packages. - Demonstrated ability to build and maintain eMASS packages. - Working knowledge of DoD ports, protocols, and services registration and boundary or data-flow documentation. - Practical knowledge of NIST 800-53 and 800-37, DoD implementation guidance, and continuous monitoring. - Familiarity with relevant DoD security tools and practices, including STIGs, vulnerability scanning, and incident or vulnerability reporting. - Understanding of cloud environments and how their technical controls map to security requirements; strong technical writing skills. - Active U.S. Secret clearance, U.S. citizenship, and a qualifying DoD baseline certification are required. The source says the certification may be obtained within 90 days.

Benefits and work setup

- Full-time position; candidates must reside in the Washington, D.C., Maryland, or Virginia area, or in the Denver or Colorado Springs area. - The source lists a base salary range of $150,000–$170,000, with potential equity and discretionary bonuses. Benefits include employer-paid health coverage, retirement contributions, wellness resources, home-office and development stipends, flexible paid time off, and parental leave.