Information System Security Officer (ISSO) III

Job Description

Job Description

Security Clearance: Active TS/SCI (Must be able to obtain a CI Poly)

Location: Hanscom AFB, MA

Job Type: Full-Time

Target Salary Range*: $132,000 - $141,000.

*This represents the potential salary range for this position depending on education level, years of experience and/or certifications in addition to other position specific requirements which may impact salary

Position Overview

The Information System Security Officer (ISSO) is responsible for maintaining the appropriate operational security posture for assigned information systems. The ISSO works closely with the Information System Security Manager (ISSM), Information System Owner (ISO), Authorizing Official/Designated Authorizing Official (AO/DAO), system administrators, and other stakeholders to support secure system operations and compliance with applicable cybersecurity requirements.

The ISSO provides day-to-day security support for information systems operating within Collateral, Sensitive Compartmented Information (SCI), and Special Access Program (SAP) environments. This role requires detailed knowledge of security operations, Risk Management Framework (RMF), authorization documentation, continuous monitoring, incident handling, configuration management, physical and environmental security, personnel security, and security training and awareness.

The primary function of this position is to support Special Access Programs for Department of Defense agencies, including Headquarters Air Force, the Office of the Secretary of Defense, and other military compartmented efforts.

Key Responsibilities

• Assist the ISSM in meeting assigned cybersecurity, compliance, and system security responsibilities.
• Prepare, review, maintain, and update system authorization packages, RMF documentation, and supporting bodies of evidence.
• Support Assessment and Authorization efforts for DoD, national agency, and contractor information systems.
• Conduct periodic reviews of information systems to ensure compliance with approved security authorization packages.
• Conduct continuous monitoring activities for assigned authorization boundaries.
• Ensure security documentation is current, complete, accurate, and accessible to properly authorized personnel.
• Coordinate proposed hardware, software, firmware, and configuration changes with the ISSM and AO/DAO prior to implementation.
• Assess the security impact of system changes and provide recommendations to the ISSM.
• Notify the ISSM of changes that may affect the authorization status or security posture of assigned systems.
• Support configuration management activities across system authorization boundaries.
• Ensure approved procedures are in place for clearing, sanitizing, and destroying hardware and media.
• Monitor system recovery processes to ensure security features and procedures are properly restored and functioning.
• Ensure audit records are collected, reviewed, analyzed, and documented, including identification and reporting of anomalies.
• Identify cybersecurity vulnerabilities and assist with the implementation of appropriate countermeasures.
• Prepare reports on the status of security safeguards applied to information systems.
• Execute the cybersecurity portion of self-inspections, including security coordination and review of system assessment plans.
• Support incident handling activities, including identification, reporting, documentation, and coordination with appropriate security personnel.
• Support physical, environmental, and personnel security requirements related to assigned systems.
• Attend required technical and security training, including training related to operating systems, networking, cybersecurity, RMF, and security management.
• Perform ISSO duties in support of internal and external customers.

QualificationsEducation

• Bachelor’s degree in Cybersecurity, Information Technology, Computer Science, Information Systems, or a related technical discipline is preferred.
• Additional relevant experience may be considered in lieu of a degree.

Experience

• 5–7 years of related cybersecurity, information assurance, systems administration, network administration, or ISSO experience.
• Experience developing, maintaining, and supporting RMF authorization packages or bodies of evidence.
• Prior experience performing duties as an ISSO, System Administrator, Network Administrator, or similar technical/security role.
• Minimum of 2 years of experience supporting Special Access Program environments.
• Experience supporting Collateral, SCI, and/or SAP information systems.
• Experience conducting continuous monitoring, audit review, vulnerability management, and security documentation maintenance.
• Experience coordinating system changes, assessing security impact, and supporting authorization boundary management.

Skills

• Working knowledge of RMF, DoD cybersecurity requirements, and information system authorization processes.
• Ability to prepare and maintain authorization documentation, security plans, control implementation details, and supporting evidence.
• Knowledge of security controls related to access control, audit and accountability, configuration management, incident response, media protection, personnel security, physical protection, and system integrity.
• Ability to review audit logs, identify anomalies, and document findings.
• Ability to identify vulnerabilities and assist with remediation or mitigation activities.
• Strong understanding of system hardening, secure configuration, patch management, and vulnerability management.
• Ability to coordinate with ISSMs, ISOs, AO/DAOs, system administrators, engineers, and security personnel.
• Strong written and verbal communication skills.
• Strong attention to detail and ability to manage security documentation in a regulated environment.
• Ability to support multiple systems, customers, and authorization boundaries.

Certifications

• DoD 8570/8140 compliant certification at IAT Level II or IAM Level II.

Preferred Qualifications

• Experience supporting Department of Defense SAP environments.
• Experience supporting Headquarters Air Force, Office of the Secretary of Defense, military compartmented programs, or similar DoD customers.
• Experience with eMASS, XACTA, or similar authorization and compliance management tools.
• Familiarity with NIST SP 800-53, CNSSI 1253, JSIG, ICD 503, and DoD SAP cybersecurity guidance.
• Experience supporting system self-inspections, security control assessments, and customer inspections.
• Experience working with classified systems, closed areas, secure facilities, and controlled media processes.
• Experience supporting vulnerability scanning, POA&M management, audit log review, and continuous monitoring.
• Experience working in environments with strict configuration management and change control requirements.
• Active security clearance with eligibility for SCI and/or SAP access, as required by contract.