IT CYBERSECURITY SPECIALIST (INFOSEC)

Job Title

Information System Security Officer (ISSO)

Duties

This position serves as an Information System Security Officer (ISSO), supporting Risk Management Framework (RMF) execution for information systems through security control implementation and assessment, authorization package development, evidence collection, vulnerability tracking, Plan of Action and Milestones (POA&M) management, and continuous monitoring.

Experienced in executing RMF activities for assigned information systems, applying cybersecurity principles, security controls, vulnerability management, continuous monitoring, and applicable federal, DoW, organizational, and Zero Trust requirements.

Experienced in evaluating security control implementation and effectiveness; maintains authorization documentation; analyzes assessment evidence and findings; manages POA&Ms and monitors security posture.

Provides technical cybersecurity guidance and recommendations to system owners and stakeholders regarding security requirements, risks, controls, remediation, and authorization decisions.

Experience in analyzing security documentation, vulnerability and configuration data, assessment findings, and system changes to identify security weaknesses, evaluate risk, and recommend remediation, mitigation, or compensation controls.

Evaluates cybersecurity impacts of system changes and resolves or recommends solutions for complex issues involving vulnerabilities, control deficiencies, technical limitations, and competing mission and security requirements.

Coordinates with technical stakeholders to validate remediation actions and security evidence and independently determines whether deficiencies have been adequately addressed.

Evaluates cybersecurity practices and controls to identify gaps, risks, and improvement opportunities associated with Zero Trust, vulnerability management, continuous monitoring, and emerging cybersecurity requirements.

Identifies recurring or systemic vulnerabilities and control weaknesses and recommends corrective actions or risk mitigation strategies.

Develops technical analyses, risk assessments, metrics, reports, and briefings on system security posture, authorization status, vulnerabilities, remediation, and continuous monitoring results.

This position serves as a senior ISSM and cybersecurity technical authority for a portfolio of complex, high-profile enterprise systems, programs, and modernization initiatives.

Establishes technical priorities and governance for RMF execution, security controls, authorization readiness, continuous monitoring, vulnerability management, and POA&M oversight.

Interprets and applies federal, DoW, organizational, and emerging cyber security requirements to resolve complex issues and ensure consistent risk management across the portfolio.

Integrates cybers security risk information across systems and programs to identify significant or systemic weaknesses and mission impacts.

Reviews and validates significant control deficiencies, remediation strategies, compensating controls, cloud security, system interconnections, software assurance, and major system changes.

Develops risk-management strategies and recommendations for complex issues extending beyond the individual system level and advises leadership on authorization, operational, acquisition, and risk decisions.

Advises senior leadership, system owners, program managers, and technical officials on cyber security risk, authorization readiness, vulnerability priorities, Zero Trust, cloud security, modernization, and emerging requirements.

Leads integration of cyber security requirements and risk considerations across engineering, acquisition, operations, and program organizations to resolve significant cross-functional issues.

Presents executive-level risk analyses, metrics, trends, and recommendations addressing portfolio security posture, systemic risks, and issues affecting mission execution.

Certifications

Positions require a current cybersecurity certification appropriate to the role and grade level in alignment with DoD 8140 cyber workforce requirements, such as Security+, CySA+, CASP+, CISSP, CISM, or an equivalent ISSO/ISSM qualifying certification.