Info System Security Officer (ISSO)
American Systems · Ashburn, VA, US
About this role
## Overview AMERICAN SYSTEMS is seeking an **Information System Security Officer (ISSO)** to support **Network Operations Center Network Management Support Services**. The ISSO will serve as a designated security professional for one or more **FISMA systems of record** and new information systems, supporting the **Assessment & Authorization (A&A) lifecycle**, **Authority to Operate (ATO)** activities, **ongoing authorization/continuous monitoring**, **vulnerability management**, and compliance with government security requirements. ## Responsibilities - Perform ISSO duties in accordance with **DHS 4300A**, **HB 1400-05D**, **FISMA guidance**, applicable **NIST publications**, and approved program SOPs. - Lead or support **A&A**, **reaccreditation**, and **continuous monitoring** for assigned information systems. - Coordinate reaccreditation kickoff activities with the agency’s Security Authorization Team; notify security leadership of upcoming requirements. - Support transition of designated systems to **Ongoing Authorization (OA)** (continuous monitoring). - Manage **Plans of Action & Milestones (POA&Ms)**: development, documentation, SME follow-up, remediation tracking, and status reporting. - Review **Information Security Vulnerability Management (ISVM)** messages; determine applicability, acknowledge notifications, track remediation, and coordinate POA&M creation. - Review weekly network scans and log information; prepare vulnerability summaries and identify critical/high-risk issues. - Maintain accurate **system asset inventories** and update the **Vulnerability Assessment Team (VAT)**; reconcile inventories with DHS detailed asset reports. - Review proposed **change requests** to ensure security compliance; update asset records and **System Security Plans (SSPs)** when systems/configurations change. - Develop, review, maintain, and submit A&A/security documentation for approval, including: - SSPs, risk assessments, **FIPS 199** categorization assessments - **ST&E** plans/results - **ATO** and **ATT** artifacts - Contingency plans, ISAs, waivers, and POA&Ms - Review/update SSPs annually or when significant system changes occur; complete required **NIST SP 800-26** or **NIST SP 800-53** assessments. - Support annual **Ongoing Authorization Review Management Board (OARMB)**, **DHS/CISA/OMB audits**, cybersecurity data calls, and **FedRAMP/cloud** activities as applicable. - Assist the **Computer Security Incident Response Center (CSIRC)** with investigations of security violations/incidents. - Support encryption and security compliance requirements, including **FIPS 197 AES-256**, **FIPS 140-2** validated cryptographic modules, **NSA Type 1/Type 2** encryption, **PKI**, and emerging **FIPS 203/204/205** requirements. - Prepare weekly ISSO reports covering ATO activities, assessments, audits, change requests, POA&Ms, ISVMs, waivers, compliance highlights, and issues needing management guidance. ## Qualifications - Approximately **5–10 years** of relevant information systems security/cybersecurity/security authorization experience (senior-level). Candidates may also support **junior-level** ISSO assignments. - In-depth knowledge of the **Risk Management Framework (RMF)**, **NIST** publications, **FISMA**, **DHS 4300A**, and **HB 1400-05D**. - Assessment and Authorization experience implementing or assessing **NIST SP 800-53** controls; supporting A&A, ATO, reaccreditation, or continuous monitoring. - Experience reviewing **Ne
Listing freshness
CronJobs last confirmed this listing 2h ago. If its source stops confirming the opening for seven days, this page is removed from active inventory.