Information Systems Security Officer (ISSO)

Accountabilities: Execute all phases of the NIST SP 800-37 DoD Risk Management Framework lifecycle, including system categorization, control selection, implementation, assessment, authorization, and continuous monitoring for IL4 and IL5 environments. Own and maintain end-to-end eMASS authorization packages, ensuring control implementation details, assessment results, supporting evidence, and monitoring status remain accurate and ready for review. Manage DISA Ports, Protocols, and Services Management (PPSM) registrations, reconciling ports, protocols, services, data flows, and boundary architecture documentation. Develop and maintain System Security Plans, control implementation narratives, Plans of Action and Milestones (POA&Ms), and other RMF documentation that accurately reflects system architecture and operations. Lead continuous monitoring activities, including monthly POA&M updates, vulnerability and patch reporting, Information Assurance Vulnerability Management (IAVM) compliance, significant change reviews, and periodic assessments. Coordinate with engineering teams to address security findings, track remediation activities, and ensure identified vulnerabilities are resolved within required timelines. Validate Security Technical Implementation Guide (STIG) compliance and analyze vulnerability scan results from ACAS and Tenable Nessus, tracking remediation against NIST 800-53 and DoD requirements. Serve as a technical point of contact for ISSMs, security assessors, and Authorizing Officials during security assessments, authorization readiness reviews, and audits. Collaborate with Product and Engineering teams to map cloud-native security controls across AWS, containers, Kubernetes, and CI/CD pipelines to DoD RMF and NIST 800-53 requirements. Translate complex DoD security policies and compliance requirements into actionable technical direction and defensible evidence for engineering teams and stakeholders. Maintain authorization readiness and a strong security compliance posture across accredited systems and supporting platform environments. Requirements: 3–5 years of hands-on experience in DoD cybersecurity, RMF authorization, or information assurance, including direct experience in an ISSO or equivalent compliance role supporting DoD Authority to Operate (ATO) packages. Demonstrated proficiency building, managing, and maintaining authorization packages in eMASS. Working knowledge of DISA PPSM registration processes, including ports, protocols, services, CAL, and system boundary and data-flow documentation. Strong practical understanding of NIST SP 800-53 (Revision 4 or 5), NIST SP 800-37 RMF, and DoD-specific cybersecurity implementation guidance. Familiarity with DoD security tools, standards, and authorization policies, including DISA STIGs, STIG Viewer, SCC, ACAS, IAVM, DISA Cloud Computing Security Requirements Guide, and continuous monitoring requirements. Understanding of modern cloud environments and architectures, particularly AWS, containers, Kubernetes, and CI/CD pipelines, and the ability to map these technologies to technical security controls. Strong technical writing skills, with the ability to produce clear, accurate, assessor-ready documentation and control implementation narratives. Active U.S. Secret security clearance. DoD 8570/8140 IAM Level I or IAT Level II baseline certification, such as Security+, CISSP, or an equivalent qualification, required or obtainable within 90 days. U.S. citizenship is mandatory for this position. Must reside in one of the approved hiring locations: Washington, DC/Maryland/Virginia or Denver/Colorado Springs, Colorado. A proactive, solutions-oriented mindset, with the ability to take ownership, overcome challenges, and deliver measurable results. Strong collaboration skills, personal accountability, autonomy, and the ability to work effectively across technical and security teams. Benefits: Annual base salary range of $150,000–$170,000, determined by professional experience, technical proficiency, seniority, and regional factors. Eligibility for equity awards through an equity incentive plan. Potential eligibility for discretionary bonuses. 100% employer-paid medical, dental, and vision coverage for employees and their dependents. 401(k) plan with a 3% company contribution. Comprehensive wellness benefits, including a One Medical membership, mental health resources, and family planning support. Technology and home office stipend for new hires. Annual professional development stipend. Flexible paid time off, in addition to all federal holidays. Generous parental leave. Flexible remote work opportunities. Employee referral bonus program.