Information System Security Officer (ISSO)

• Assist the ISSM in executing information system security duties and responsibilities.
• Prepare, review, and update system authorization packages.
• Maintain security control documentation and continuous monitoring artifacts in accordance with applicable Risk Management Framework (RMF) and JSIG requirements.
• Track and manage Plans of Action and Milestones (POA&M) through closure.
• Conduct continuous monitoring activities for authorization boundaries under assigned purview.
• Perform security impact assessments and coordinate any changes or modifications to hardware, software, or firmware with the ISSM and AO/DAO prior to implementation.
• Conduct periodic reviews of information systems to verify compliance with the security authorization package.
• Support STIG compliance, vulnerability scanning, and remediation coordination with system owners and administrators.
• Notify the ISSM when changes occur that may affect the authorization determination of assigned information systems.
• Ensure approved procedures are in place for clearing, sanitizing, and destroying various types of hardware and media.
• Ensure audit records are collected, reviewed, and documented, including any anomalies.
• Monitor system recovery processes to verify that security features and procedures are properly restored and functioning correctly.
• Ensure all information system security documentation is current and accessible to properly authorized individuals.
• Execute the cybersecurity portion of the self-inspection, including security coordination and review of all system assessment plans.
• Identify cybersecurity vulnerabilities and assist with the implementation of countermeasures.
• Support incident handling, containment, and reporting in coordination with the ISSM.
• Prepare reports on the status of security safeguards applied to information systems.
• Perform ISSO duties in support of in-house and external customers.
• Assist Department of Defense, national agency, and contractor organizations with the development of assessment and authorization (A&A) efforts.
• Attend required technical and security training relative to assigned duties, including operating system, networking, and security management topics.

• Bachelor's degree, or four years of additional relevant experience in lieu of a degree.
• Five or more years of ISSO or equivalent information assurance experience.
• Working knowledge of the Risk Management Framework and the system authorization process.
• Demonstrated experience developing and maintaining authorization documentation.
• Ability to communicate security requirements clearly to both technical and non-technical stakeholders.

Certifications

• Must meet position and certification requirements outlined in DoD 8140 for Information Assurance Technician Level II or Information Assurance Manager II within six months of the date of hire.