Information Systems Security Officer (ISSO)

Information Systems Security Officer (ISSO)

Title: Information Systems Security Officer (ISSO)

ID: 1819

Security Clearance Requirement: Secret

Location: 100% Remote

Employment Type: Full Time

At Imagine Believe Realize, LLC (IBR) we are driven by innovation, transformation and a relentless pursuit of excellence. As an industry leader delivering impactful results, we thrive on solving complex technical challenges and developing cutting-edge solutions that empower our customers and advance critical missions. IBR is a fast-growing company fueled by passion, curiosity, and innovative thinking – where every team member has the opportunity to continuously learn, unlock their full potential, and redefine what is possible in engineering and technology. If you are inspired by innovation, eager to make a difference, and ready to bring your creativity and expertise to a mission-focused team, we invite you to join us and together, we will shape the future. Let's Make It Real!

The Information Systems Security Officer (ISSO) must be able to meet the key criteria below:

• Location: 100% remote. This is a United States based position, and candidates must reside in the continental United States to be eligible for employment.
• Years' Experience: 5+ years professional experience in a cybersecurity related field
• Education: Bachelor's Degree in IT related field
• Security Clearance: IBR is a federal contractor. Applicants must be able to obtain and maintain a Secret security clearance issued by the Department of War (DoW). This agency handles and adjudicates the security clearance process. NOTE: United States Citizenship is required as part of the eligibility criteria to be able to obtain this type of security clearance.
• Employment Type: Full Time Work Schedules: IBR promotes work-life balance by offering flexible scheduling options. Standard business hours are aligned to the Eastern Time Zone.
• Key Skills:

• Experience independently leading and executing the complete Risk Management Framework (RMF) lifecycle for IATT/ATO activities involving custom on-prem and AWS cloud solutions.
• Professional experience using eMASS to develop, manage, update, and maintain RMF authorization documentation
• Experience with vulnerability management tools and processes, including ACAS scanning and vulnerability tracking through VRAM.
• Professional experience reviewing, interpreting, and implementing STIGs.
• Experience developing, managing, maintaining, and supporting comprehensive RMF documentation packages including System Security Plans (SSPs), security control implementation statements, Security Assessment Reports (SARs), Plans of Action and Milestones (POA&Ms), and supporting security assessment evidence.
• Cybersecurity related certification preferred.

Position Overview As an Information Systems Security Officer at IBR, you will play a key role in supporting a government program by applying NIST SP-800-53 controls, monitoring security posture, analyzing vulnerabilities, and coordinating remediation across AWS, applications, APIs, and infrastructure. As a member of our program that provides support to the U.S. Navy, you will collaborate with technical leaders, business stakeholders, and a multi-disciplinary team to ensure solutions are scalable, secure and forward-thinking, while remaining aligned with organizational and program goals.

Responsibilities

• Ability to independently lead, manage, and execute the complete RMF lifecycle for assigned information systems, from system categorization and security control selection through implementation, assessment, authorization, and continuous monitoring, to obtain and maintain an Authority to Operate (ATO).
• Coordinate RMF activities with U.S. Navy customers, government stakeholders, system owners, engineering teams, and other program personnel to ensure security requirements are implemented and authorization milestones are achieved.
• Develop, manage, maintain, and support comprehensive RMF documentation packages including System Security Plans (SSPs), security control implementation statements, Security Assessment Reports (SARs), Plans of Action and Milestones (POA&Ms), and supporting security assessment evidence.
• Manage and maintain RMF authorization documentation, security control assessments, compliance information, and authorization package records within the Enterprise Mission Assurance Support Service (eMASS), ensuring documentation and security control implementation evidence are accurate and current.
• Interpret and apply applicable Cybersecurity Control Security Requirements Guides (CCSRGs) to assess system security requirements, validate security control implementation, identify compliance gaps, and support RMF authorization and continuous monitoring activities.
• Interpret, assess, and apply NIST SP 800-53 security controls and applicable government cybersecurity requirements to custom on-premises and AWS cloud environments, identifying control gaps and coordinating implementation and remediation activities.
• Conduct and coordinate vulnerability management activities, including ACAS scanning, vulnerability analysis, Security Technical Implementation Guides (STIGs) reviews, and tracking remediation through VRAM and other applicable tools and processes.
• Perform continuous monitoring of activities, including monthly security reporting, vulnerability scan analysis, security control reviews, account and access reviews, configuration changes, and tracking of corrective actions to maintain an effective security posture.
• Develop, coordinate, and execute security assessment and testing plans to evaluate system security requirements, assess the implementation and effectiveness of security controls, identify vulnerabilities and deficiencies, and document assessment results and supporting evidence required for RMF authorization package submission and approval.
• Identify, document, assess, and communicate cybersecurity risks and deficiencies.
• Coordinate directly with program stakeholders to gather, document, and translate business requirements, facilitate stakeholder and team meetings, provide security reports, and track security work through completion.
• Assist the customer in preparing training and tabletop exercises for contingency planning, incident response and disaster recovery.

Qualifications

• Must have 5+ years of professional experience in Cybersecurity.
• Demonstrated experience serving as an ISSO or in a comparable cybersecurity role with direct responsibility for independently managing system security authorization, RMF compliance, and ongoing security operations within a federal government environment.
• Must be able to obtain and maintain a Secret security clearance.
• Must have a Bachelor's Degree in a Cybersecurity or IT related field.
• Cybersecurity related certification preferred.
• Demonstrated experience independently leading and executing the complete RMF lifecycle for IATT/ATO activities involving custom on-prem and cloud solutions. This includes experience with RMF preparation, system categorization, supporting information systems, security controls selection and implementation, security control assessments, authorization package development and submission, coordination of ATO approvals and authorization, and continuous monitoring.
• Experience preparing, maintaining, and managing comprehensive RMF authorization documentation packages, including SSPs, SARs, POA&Ms, Security Assessment Reports, and supporting assessment evidence.
• Must have strong working knowledge and professional experience applying NIST SP 800-53 security controls and applicable federal cybersecurity requirements within the RMF.
• Experience with vulnerability management tools and processes, including ACAS scanning and vulnerability tracking through VRAM.
• Professional experience reviewing, interpreting, and implementing STIGs and assessing system compliance with applicable security configuration requirements.
• Must have demonstrated professional experience using eMASS to develop, manage, update, and maintain RMF authorization documentation, security control assessments, compliance records, and supporting evidence.
• Must have demonstrated professional experience interpreting and applying applicable CCSRG requirements to assess system security controls, validate compliance, identify deficiencies, and support authorization activities.
• Experience evaluating applications, infrastructure, database, and API security, including familiarity with API-based security mechanisms and the OWASP framework for web application vulnerabilities.
• Strong understanding of AWS cloud environments, architecture, and security services, including experience assessing and implementing security controls within cloud-based environments.
• Experience conducting continuous monitoring, analyzing vulnerability scan results, preparing security status reports, and maintaining ongoing system security compliance.
• Experience using cybersecurity tools or scanners to evaluate system security posture, including scanning or reporting for web applications, databases, containers, or other system components.
• Experience assessing security control deficiencies, evaluating cybersecurity risks, documenting findings, developing remediation plans, and tracking corrective actions through resolution.
• Strong communication and organizational skills, with the ability to independently manage multiple RMF activities, coordinate with government customers and technical stakeholders, communicate security risks, and drive deliverables through completion.
• Experience with requirements analysis, security architecture and design, translating cybersecurity requirements into technical security controls, and coordinating implementation with engineering and technical teams.
• Experience gathering and creating security requirements, coordinating with stakeholders, facilitating meetings, and tracking security work through completion.
• Working knowledge of Agile and DevSecOps practices and cybersecurity, network, systems, and software engineering principles.
• Familiarity with Atlassian tools, such as Jira, Confluence, and/or Splunk.

Application Deadline: Applications will be reviewed as received and accepted on a continuous basis until the position is filled