Information Systems Security Officer

Job Description

Job Description

Please note: This is a cybersecurity and industrial security compliance role. It is not an armed security guard position.

Grow your security career across cyber and industrial security.

At API, our ISSO isn’t buried in a single lane. You’ll keep DoD systems authorized and compliant, maintain our COMSEC account, and support industrial security, working directly with our ISSM, government customers, and leadership. The role has real breadth and real visibility. Your work will shape how a growing defense contractor safeguards its people, programs, and protected information.

If you’re a cybersecurity professional who wants to grow across RMF, COMSEC, and industrial security, takes pride in getting the details right, and keeps records an auditor can’t fault, we want to talk to you.

Employment Type: Full-Time
Experience: 3+ Years
Security Clearance: Active Secret Required
Reports To: Information System Security Manager (ISSM) / Security Management

Position Summary

We are seeking a detail-oriented and motivated Information System Security Officer (ISSO) with 3+ years of experience to support Department of Defense (DoD) information systems security, cybersecurity compliance, and communications security (COMSEC) activities.

The selected candidate will work closely with the Information System Security Manager (ISSM) to support the Risk Management Framework (RMF), maintain security authorization documentation within the Enterprise Mission Assurance Support Service (eMASS), and assist with continuous monitoring activities.

This individual will also serve as the COMSEC Manager, or Alternate COMSEC Manager, for the facility’s COMSEC account. In that role, they will be responsible for the receipt, control, accountability, storage, and destruction of COMSEC material in accordance with NSA and DoD requirements.

In addition, this individual will also be the Facility Security Officer (FSO) with personnel security, industrial security, and administrative security functions.

Primary Responsibilities – ISSO 

• Support implementation and maintenance of cybersecurity policies, procedures, and security controls in accordance with DoD RMF requirements.
• Assist with maintaining system authorization packages and security documentation within eMASS.
• Develop, review, and update System Security Plans (SSPs), Plans of Action and Milestones (POA&Ms), and other RMF artifacts.
• Support Assessment and Authorization (A&A) activities and ongoing Authorization to Operate (ATO) requirements.
• Assist with implementing and assessing applicable NIST SP 800-53 security controls.
• Perform continuous monitoring activities to maintain system security compliance.
• Review vulnerability scan results and assist with tracking remediation efforts.
• Support implementation and validation of applicable Security Technical Implementation Guides (STIGs).
• Assist with user account management, access control reviews, and system security documentation.
• Review and maintain system configuration management and change control records.
• Identify, document, and escalate cybersecurity vulnerabilities, incidents, and compliance concerns.
• Coordinate with system administrators, technical personnel, and security stakeholders to resolve security findings.
• Support cybersecurity inspections, security control assessments, and government audits.
• Maintain accurate security records and provide regular status updates to the ISSM.

Secondary Responsibilities – FSO Support 

• Assist the FSO with personnel security clearance processing and administrative security activities.
• Support clearance verification, tracking, and record maintenance using DISS, NBIS, and NISS, as authorized.
• Assist with employee security onboarding, out-processing, briefings, and debriefings.
• Process and track visit authorization requests.
• Support foreign travel reporting and other required personnel security reporting.
• Maintain personnel security files and documentation in accordance with applicable requirements.
• Assist with annual security awareness training and employee security education.
• Support preparation for DCSA security reviews and inspections.
• Assist with maintaining compliance with NISPOM (32 CFR Part 117).
• Perform additional security support duties as assigned.

COMSEC Manager Responsibilities 

• Serve as the appointed COMSEC Manager or Alternate COMSEC Manager for the facility’s COMSEC account.
• Manage the receipt, issue, transfer, storage, inventory, and destruction of COMSEC material and keying material in accordance with NSA/CSS policy and 32 CFR Part 117.
• Operate within the Key Management Infrastructure (KMI) to order, receive, and manage keying material, as authorized.
• Maintain accurate COMSEC accounting records and prepare required reports, including SF-153 COMSEC Material Reports.
• Conduct and document required semiannual and change-of-manager inventories of COMSEC material.
• Ensure proper physical safeguarding of COMSEC material, including storage, access controls, and two-person integrity (TPI) where required.
• Load, manage, and track cryptographic equipment and key fill devices (e.g., Simple Key Loader), as applicable.
• Conduct COMSEC and cryptographic access briefings and debriefings, and maintain related access records.
• Develop and maintain COMSEC standard operating procedures and emergency action/destruction plans.
• Identify, report, and investigate COMSEC incidents in accordance with applicable reporting requirements.
• Train and oversee COMSEC users and local elements on proper handling and accountability procedures.
• Prepare for and support COMSEC audits and inspections by the NSA Central Office of Record (COR), DCSA, or other authorized government representatives.

Required Qualifications

• 2–3 years of experience supporting cybersecurity, information systems security, or RMF compliance activities.
• Active Secret security clearance.
• U.S. citizenship and eligibility for appointment as COMSEC Manager, including willingness to complete required NSA COMSEC Manager and KMI training if not already completed.
• Working knowledge of DoD Risk Management Framework (RMF) processes.
• Experience working with eMASS or maintaining RMF authorization documentation.
• Familiarity with NIST SP 800-53 security controls.
• Understanding of ATO requirements, continuous monitoring, and POA&M management.
• Familiarity with STIGs, vulnerability management, and security compliance assessments.
• Strong technical documentation, organizational, and communication skills.
• Ability to work effectively with system administrators, ISSMs, and government security personnel.

Preferred Qualifications

• CompTIA Security+ certification or equivalent DoD-approved certification appropriate to assigned duties.
• Experience supporting DoD A&A activities.
• Familiarity with ACAS, Nessus, SCAP, or similar vulnerability assessment tools.
• Experience maintaining SSPs, security control implementation statements, and RMF artifacts.
• Familiarity with DoD cybersecurity policies and requirements.
• Working knowledge of NISPOM and industrial security procedures.
• Experience using DISS, NBIS, or NISS.
• Experience supporting government inspections, COMSEC audits, or security assessments.

Education

Associate’s or bachelor’s degree in Cybersecurity, Information Technology, Computer Science, or a related discipline preferred. Equivalent relevant experience and professional certifications may be considered.

Desired Skills and Attributes

• Strong attention to detail and ability to maintain accurate compliance and accountability records.
• Ability to prioritize multiple assignments and meet established deadlines.
• Effective communication with technical and nontechnical personnel.
• Willingness to learn additional cybersecurity, COMSEC, and industrial security responsibilities.
• Ability to work independently with appropriate ISSM oversight.
• Commitment to protecting classified information and COMSEC material and maintaining regulatory compliance.

Why API

• Mission: You'll support programs that are critical to national defense.
• Growth: You'll have room to expand your scope as our programs grow.

Compensation: The good-faith salary range for this position is $90,000 – $100,000 annually. Final base salary will be determined based on factors including the scope and responsibilities of the role and the candidate's experience, education, skills, and current market conditions.

Benefits and other compensation: API offers a comprehensive benefits package that includes medical, dental, and vision insurance; a 401(k) retirement plan with employer contribution; paid time off and paid holidays; life and disability insurance.

Sounds exciting, doesn't it? Apply now! We will be looking to fill this position quickly!

Advanced Programs, Inc. (API) is an Equal Opportunity Employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, creed, sex (including pregnancy, childbirth, and related medical conditions), gender identity, sexual orientation, national origin, ancestry, age, physical or mental disability, genetic information, marital status, familial status, military or veteran status, or any other characteristic protected by applicable federal, state, or local law. API complies with the New Hampshire Law Against Discrimination (RSA 354-A) and will provide reasonable accommodation to qualified individuals with disabilities in accordance with applicable law.