Information Systems Security Officer

Information Systems Security Officer

The Information Systems Security Officer will lead cybersecurity efforts for complex software projects within a United States Department of Defense (DoD) environment, with a strong focus on Risk Management Framework (RMF) compliance and secure cloud-based workloads. This role drives the creation, submission, and maintenance of security packages and authorizations, including obtaining and sustaining Authorization to Operate (ATO) for Amazon Web Services (AWS) container-based solutions. The position requires deep expertise in DoD cybersecurity processes, tools, and standards, as well as strong communication and collaboration skills across engineering, cybersecurity, business, and customer stakeholders.

Responsibilities:

• Serve as an Information Systems Security Engineer (ISSE) for DoD software projects, providing cybersecurity leadership and guidance across the full system lifecycle.
• Generate and submit complete System Security Packages (SSPs), Plans of Action and Milestones (POA&Ms), and other required artifacts to support DoD Risk Management Framework (RMF) and Security Technical Implementation Guide (STIG) processes.
• Apply DoD cybersecurity tools, including eMASS and STIG Viewer, to build, manage, and validate security packages and supporting documentation.
• Obtain and maintain at least one DoD Authorization to Operate (ATO) for AWS-deployed container-based workloads, ensuring ongoing compliance with DoD security requirements.
• Inform and define software mitigation requirements based on results from static application security testing (SAST) tools such as SonarQube and container scanning tools such as Trivy.
• Recommend and validate data protection mechanisms, including encryption and access control strategies, to safeguard sensitive information in deployed workloads.
• Test and verify security controls to ensure they function as designed and effectively reduce risk across applications and infrastructure.
• Conduct threat modeling activities to identify potential attack vectors and prioritize security mitigations for software systems and cloud workloads.
• Lead vulnerability management activities, including identifying, tracking, and coordinating remediation of security findings across development and operations teams.
• Monitor the security posture of deployed workloads, leveraging appropriate tools and processes to detect and respond to anomalous or malicious activity.
• Collaborate effectively with engineering, cybersecurity, business, and customer stakeholders throughout the RMF cybersecurity lifecycle, ensuring clear communication of risks, requirements, and progress.
• Provide security guidance and input to DevSecOps teams across multiple software releases, helping integrate security best practices into continuous integration and deployment processes.
• Use system security tools such as Wiz or eMASSter to support security posture assessment, reporting, and ongoing compliance activities.
• Contribute to the design and operation of Security Operations Center (SOC) functions, using tools such as Splunk or CloudWatch to support monitoring and incident response.
• Leverage AWS security services, including Security Hub and GuardDuty, to strengthen detection, response, and compliance capabilities in cloud environments.
• Apply knowledge of CIS benchmarks and other industry security standards to align system configurations and controls with recognized best practices.
• Support or coordinate activities related to penetration testing, fuzz testing, and dynamic application security testing (DAST), and use results to drive remediation and improvement.
• Document security requirements, decisions, and outcomes clearly and comprehensively to support audits, assessments, and continuous improvement.

Essential Skills:

• At least 5 years of experience serving as an Information Systems Security Engineer (ISSE) for United States Department of Defense (DoD) software projects.
• Proven experience generating and submitting System Security Packages (SSPs), Plans of Action and Milestones (POA&Ms), and other artifacts required for DoD Risk Management Framework (RMF) and Security Technical Implementation Guide (STIG) processes.
• Hands-on experience applying DoD cybersecurity tools such as eMASS and STIG Viewer to develop and manage security packages.
• Demonstrated success obtaining and maintaining at least one DoD Authorization to Operate (ATO) for an AWS-deployed container-based workload.
• Strong background in cyber security, including threat modeling, vulnerability management, security monitoring, and data protection for deployed workloads.
• Experience informing software mitigation requirements based on output from static application security testing (SAST) tools such as SonarQube.
• Experience using container scanning tools such as Trivy to identify and remediate vulnerabilities in containerized workloads.
• Demonstrated expertise in recommending and validating data protections and testing security controls for complex systems.
• Track record of effective communication and collaboration throughout the RMF cybersecurity lifecycle with engineering, cybersecurity, business, and customer stakeholders.
• Possession of one or more relevant cybersecurity certifications, such as CISSP, CASP, or Security+.

Additional Skills & Qualifications:

• Experience with United States Intelligence Community (IC) system cybersecurity processes and tools.
• Background in establishing or operating Security Operations Center (SOC) functions, including use of tools such as Splunk or CloudWatch.
• Hands-on experience with AWS security services, such as Security Hub and GuardDuty, to enhance cloud security monitoring and compliance.
• Experience serving as an ISSE on a DevSecOps team through multiple software releases, integrating security into continuous delivery pipelines.
• Familiarity with system security tools such as Wiz or eMASSter for posture assessment and compliance tracking.
• Knowledge of CIS benchmarks and other industry security standards, and the ability to apply them to system hardening and configuration.
• Exposure to penetration testing, fuzz testing, and dynamic application security testing (DAST) tools and techniques, with the ability to interpret results and support remediation.

Work Environment:

The role focuses on securing DoD and cloud-based software workloads, particularly AWS-deployed container environments, using a range of cybersecurity tools, frameworks, and industry standards. You will work closely with engineering, cybersecurity, business, and customer stakeholders in a collaborative setting that values clear communication and thorough documentation. The environment emphasizes adherence to DoD RMF, STIG requirements, and ATO processes, and makes extensive use of tools such as eMASS, STIG Viewer, SonarQube, Trivy, Wiz, eMASSter, Splunk, CloudWatch, and AWS security services like Security Hub and GuardDuty. The position supports a culture of continuous improvement in security posture, integration with DevSecOps practices, and proactive monitoring and vulnerability management across deployed workloads. Dress code and specific onsite or remote arrangements are determined by organizational policies and project needs.

Job Type & Location:

This is a Contract position based out of Annapolis, MD.

Pay and Benefits:

The pay range for this position is $120000.00 - $153920.00/hr. Individual compensation offered for this position within this range will depend on many factors, including qualifications, skills, relevant experience, job knowledge, geographic location, internal equity, and other pertinent job-related factors. Eligibility requirements apply to some benefits and may depend on your job classification and length of employment. Benefits are subject to change and may be subject to specific elections, plan, or program terms. If eligible, the benefits available for this temporary role may include the following: • Medical, dental & vision • Critical Illness, Accident, and Hospital • 401(k) Retirement Plan – Pre-tax and Roth post-tax contributions available • Life Insurance (Voluntary Life & AD&D for the employee and dependents) • Short and long-term disability • Health Spending Account (HSA) • Transportation benefits • Employee Assistance Program • Time Off/Leave (PTO, Vacation or Sick Leave)

Workplace Type:

This is a hybrid position in Annapolis, MD.

Application Deadline:

This position is anticipated to close on Oct 2, 2026.