Information Systems Security Officer (ISSO)

Support role to perform tasks related to Cybersecurity and Assessment & Authorization (A&A) to obtain and maintain Authorizations to Operate (ATOs) for assigned systems. This position will be part of a team, supporting the Information Owner, and assisting the ISSM, to implement actions needed to document current/future baselines and new capabilities in the NIST/RMF-approved process

• Document and facilitate movement of multiple information systems through the RMF process and maintain authorizations through continuous monitoring and annual reviews 
• Promote solutions to complex problems (broadly defined) that require the regular use of expertise, creativity, specialized theories and knowledge 
• Serve as Subject Matter Expert (SME) on one or more technologies/skills related to A&A activities 
• Participate in risk and vulnerability assessments (as required) of information systems to identify vulnerabilities, risks, and protection needs 
• Actively lead and participate in regular A&A status meetings with government and contract personnel to facilitate progress and address potential issues of RMF system efforts 
• Participate in sessions aimed at identifying, planning, and executing strategies in response to emerging cybersecurity/RMF policies 
• Maintain awareness and knowledge of evolving security and risk management standards and communicate and apply relevant changes to existing processes 
• Develop, update, and/or review RMF documentation to include Security Plans, Implementation Plans, Plans of Action and Milestones (POA&Ms), and Risk Assessment Reports 
• Assess system compliance against NIST, DoD, and NSA security requirements to include the NIST 800-53 controls, and DISA Security Technical Implementation Guides (STIGs) and Security Requirements Guides (SRGs) 
• Analyze security controls and the impact of significant changes would introduce to the environment 
• Produce evidence as necessary to support compliance status of NIST, DoD, and NSA security compliance 
• Work with system administrators, engineers, and developers to create or update system/site policies, procedures, and process guides 
• Coordinate with other system SMEs to identify and develop authorization boundary diagrams, architecture diagrams, and hardware and software inventories 
• Evaluate potential security risks and make recommendations regarding corrective, mitigation, and recovery actions 
• Lead or attend meetings with system stakeholders to discuss status of efforts 
• Maintain reports to leadership regarding system/program status
• Assist other BIG SAFARI programs/projects with A&A efforts (as directed

• A minimum of 8 years of related experience with a Bachelor’s degree, 6 years with a Master’s degree, a PhD with 3 years’ experience, or equivalent experience is typically required
• Working knowledge of Cybersecurity / Information Technology, or four (4) years of hands-on experience with RMF, Cybersecurity/Information Technology
• Must have a TS/SCI 
• Demonstrated efficiency and experience in RMF package development, including Plans of Actions and Milestones, Security Plans, Risk Assessments, architecture diagrams, hardware/software inventories, and system/site policies, procedures, and processes
• Familiarity and/or experience with XACTA, eMASS, etc
• Familiarity with NIST publications, DISA STIGS, and SRGs
• Experience in assessing controls/systems using NIST 800-53 and/or DISA STIGs and SRGs
• Excellent customer service and organization skills
• Excellent oral and written communication skills
• Ability to travel up to 25% (CONUS/OCONUS)