Information System Security Officer (ISSO)

What You’ll Do:

As the Information Systems Security Officer (ISSO), you will support cybersecurity compliance, assessment and authorization, and continuous monitoring of information systems.

The ISSO will coordinate with Government cybersecurity personnel, Information System Security Managers (ISSMs), system administrators, network administrators, and engineering teams to implement security requirements, maintain authorization documentation, and address vulnerabilities.

This position requires on-site work at ASEC’s corporate office in Lexington Park, MD. Some travel to supported locations may be required.

Key Responsibilities:

• Support Risk Management Framework (RMF) activities throughout the system lifecycle, including security control implementation, assessment preparation, authorization, and continuous monitoring.
• Develop, update, and maintain cybersecurity documentation, including System Security Plans (SSPs), security control implementation statements, supporting evidence, and authorization package artifacts.
• Maintain system security records and authorization documentation in eMASS or other Government-designated repositories.
• Coordinate with technical teams to maintain accurate hardware and software inventories, system boundary descriptions, network diagrams, and configuration baselines.
• Perform and review vulnerability assessments using the Assured Compliance Assessment Solution (ACAS), applicable DISA Security Technical Implementation Guides (STIGs), and the Security Content Automation Protocol (SCAP) Compliance Checker.
• Evaluate scan results and STIG findings, coordinate remediation with system and network administrators, and validate corrective actions.
• Develop and maintain Plans of Action and Milestones (POA&Ms), track remediation progress, and prepare mitigation statements and supporting documentation for Government review.
• Monitor compliance with applicable cybersecurity policies, approved system configurations, and authorization conditions.
• Review proposed hardware, software, network, and system configuration changes for cybersecurity impacts and support established configuration management processes.
• Coordinate cybersecurity requirements for system installations, upgrades, integration activities, and deployments.
• Review security logs and monitoring information, identify potential concerns, and coordinate follow-up with appropriate technical and cybersecurity personnel.
• Report suspected cybersecurity incidents through established channels and assist with evidence collection, documentation, and corrective actions.
• Support inspections, security control assessments, and authorization reviews by organizing evidence, addressing findings, and tracking follow-up actions.
• Up to 10% travel will be expected.

This description outlines the general nature and scope of the role. Additional duties may be assigned as necessary.