Standard Job Description

Ensure compliance to governing documents and security policies and assist in regulatory periodic assessments. Implements and tests state-of-the-art secure operating systems, networks, and database solutions. Stays current with system vulnerabilities and provides current security training to all system users. Conducts risk assessments and provides recommendations for secure implementation and compliance in accordance with government regulations and information assurance/cybersecurity guidelines. Creates, maintains and submits information system security documents and reports to regulatory agencies. Assesses and mitigates system security threats/risks throughout the program life cycle; validates system security requirements definition and analysis; establishes system security documentation; assists with the implementation of security procedures; verifies information system security requirements; performs information system certification and accreditation planning, testing, assessing and liaison activities. Familiar with information system security architectural documentation standards. Able to apply information assurance / cyber security standards, directives, guidance and policies to an architectural/risk based framework. Provide architectural / risk based analysis of information assurance / cyber security features and relate existing system to future needs and trends and requirements. For engineers providing security information assurance, use Info Assurance Engineer (E254, L254). For security professionals providing systems security analysis, use Computer Systems Security Analysis (E121, L121).

Long Description

The position will serve as the Lead ISSO for the Governance & Compliance Team Lead position, responsible for establishing and maintaining the security posture of assigned information systems across the classified environments. Reporting to the Information System Security Manager, the position will serve as the primary cybersecurity liaison with program managers, auditors, configuration management teams, and external assessment bodies.

 

The role drives the development, upkeep, and validation of all authorization to operate (ATO) artifacts such as: system security plans, hardware and software inventories, network diagrams, and user listings to ensure that security controls are fully implemented, continuously monitored, and documented in compliance tools such as eMASS and Q Compliance. Core duties include coordinating RMF activities, conducting self inspections and readiness assessments, managing continuous monitoring processes, and maintaining up to date compliance dashboards. The Team Lead also oversees configuration management, controls access and privileged accounts, administers interconnection security agreements, and ensures that security awareness and training requirements are met for all personnel. Incident response responsibilities encompass developing and exercising response plans, coordinating real world or simulated events, and documenting all actions and lessons learned.

 

Additionally, the position develops and maintains contingency and media protection plans, verifies backup and sanitization procedures, and provides regular briefings to leadership on risk, compliance status, and remediation progress. Candidates should have a minimum of five years of experience in continuous monitoring, security control assessment, and compliance management within DoD or comparable regulated environments, with strong knowledge of RMF, NIST SP 800‑53, and associated tooling, as well as proven leadership and communication skills. This position requires flexibility to support mission critical tasks, including off shift work when necessary, to ensure the organization’s information systems remain secure, auditable, and mission ready.

 

Basic Qualifications

All candidates must possess a Secret Clearance.

All candidates must possess a DoD 8570 IAM Level I certification or higher (e.g., Security + CE, CAP, CASP CE, CISM, CISSP, GSLC, or equivalent).

Demonstrated experience applying and documenting policy and system configurations that satisfy NIST 800-53 Security Control requirements across all Control Families.

 

Demosntrate experience with eMASS.

Ability to interpret the requirements necessary for the effective implementation of Security Controls. Technologies include but are not limited to Windows, Linux, Virtualization, Network Infrastructure, etc.

Ability to develop and update relevant RMF artifacts such as the System Security Plan (SSP), Plan of Actions and Milestones (POA&M), Security Controls Traceability Matrix (SCTM), as well as the associated security policies and procedures.

Desired Skills

Strong interpersonal skills with the ability to influence others to gain support.

Demonstratable experience conducting internal and external customer assessments identifying areas for improvement and developing and implementing corrective action plans.

Proven ability to evaluate proposed changes or additions to the information system, including: assessing their security relevance, providing advisory support to the ISSM, ensuring compliance with relevant regulations and standards.

Prior experience as an Information System Security Manager (ISSM) or Information System Security Officer (ISSO), with a proven track record of: Collaborating with a team of ISSOs to satisfy requirements and achieve goals and providing leadership and guidance on information system security matters.

Ability to perform continuous monitoring activities using Industry Standard tools such as Tenable Nessus, Security Center, Splunk, HBSS ePO, etc.

Experience leveraging Defense Information System Agency (DISA) Security Technical Implementation Guides (STIGs) and configuration standards to support system hardening.