Information System Security Officer (ISSO)

Information System Security Officer (ISSO)Applied Research Associates, Inc. (ARA), Southwest Division (SWD) is looking for an experienced Information System Security Officer (ISSO) to join our security team located in Albuquerque, New Mexico. The Information System Security Officer (ISSO) supports the ISSM in the management, operation, and compliance of classified information systems (IS) operating under the National Industrial Security Program (NISP). This role is governed by the requirements of 32 CFR Part 117 (NISPOM Rule) and the DCSA Assessment and Authorization Guide (DAAG), which implements the Risk Management Framework (RMF) for cleared contractor facilities. The ISSO serves as a hands-on security practitioner responsible for the day-to-day security posture of assigned systems, ensuring continuous compliance with DCSA authorization requirements and maintaining a valid Authority to Operate (ATO).Essential Functions as an ISSOPossessing sufficient experience and technical competence commensurate with the complexity of the systems to include patch management, account management, STIGs/SCAPs, application updates and installs, hardware configuration and troubleshootingEnsure all hardware and software additions, removals, and modifications follow approved change management processesMaintain configuration management documentation for all hardware and software changes to classified systemsImplement and validate security controls on classified systems per NIST SP 800-53, CNSSI 1253, and applicable STIGs.Ensuring user activity monitoring data and audit records are analyzed, stored, and protected in accordance with the ITPSO policies and procedures and System Security Plan (SSP)Review system audit record findings related to inappropriate or unusual activity and escalate findings to the ISSMReport all security-related incidents to the ISSM in accordance with 32 CFR Part 117 requirementsAssess changes to assigned systems that could affect authorization status and notify the ISSMAssist and support the ISSM in all the following tasks:Executing all phases of the RMF lifecycle: Prepare, Categorize, Select, Implement, Assess, Authorize, and Monitor to include decommissionDevelopment, maintenance, and continuous updating of Information SystemsPopulate and maintain system records, artifacts, and security documentation in eMASS throughout the RMF lifecyclePreparation and submission of authorization packages through the Package Approval Chain (PAC) workflowConducting periodic assessments and continuous monitoring of authorized systems and providing the corrective actions for all identified findings and vulnerabilitiesDevelopment and tracking of Plans of Action and Milestones (POA&Ms) for identified vulnerabilitiesExperience and Skills RequiredMinimum 2-4 years of experience in information technology, with at least 2 years in an ISSO or equivalent role supporting classified information systemsDemonstrated working knowledge of 32 CFR Part 117 §117.18, the DCSA Assessment and Authorization Guide (DAAG), and NIST 800-series publicationsExperience managing the RMF lifecycle for classified information systems under DCSA cognizanceActive (or ability to obtain) Top Secret clearance with SCI eligibility or clearance commensurate with the highest classification level processed on facility systemsStrong technical knowledge of Windows and/or Linux security hardening, STIG application, network security fundamentals, and audit log managementExperience with classified system configuration management, media control, and sanitization/destruction proceduresCore CompetenciesTechnical understanding of classified system security controls, network architecture, and risk managementKnowledge of NISPOM and related CFRs, DAAG, NIST SPs, CNSSI directiveAnalytical thinking, technical writing, and the ability to produce clear security documentation (SSPs, POA&Ms, incident reports)Effective collaboration with the ISSM, FSO, ITPSO, IT staff, and program managersDiscretion and integrity in handling classified information and sensitive cybersecurity dataCommitment to continuous professional development and staying current with evolving cybersecurity threats and DCSA guidancePreferredSecurity+Prior industry ISSO or cybersecurity assessor experience (DCSA, NSA, or IC)Knowledge of cross-domain solutions, classified cloud environments (IL4/IL5), and network interconnection securityExperience with eMASS or equivalent RMF workflow tools, vulnerability scanners, SIEM/Auditing and STIG Viewer / SCAP compliance toolQualificationsBachelors or better in Cybersecurity or related field.2-4 years: Relevant work experienceEqual Opportunity Employer/Protected Veterans/Individuals with Disabilities This employer is required to notify all applicants of their rights pursuant to federal employment laws. For further information, please review the Know Your Rights notice from the Department of Labor.