Information Security Officer (ISSO)

Salary: $120,000 - 160,000 per year Requirements:

• We require a bachelors degree in cybersecurity, information technology, or a related discipline, or equivalent practical experience, along with 5–7+ years serving as an ISSO or in a senior DoD RMF compliance role.
• We need an active Top Secret clearance with SCI eligibility; readiness to pursue a CI or full-scope polygraph for SAP suitability is strongly preferred.
• We require DoD 8570.01-M / 8140.03 compliance at IAM Level II or III, such as CAP, CISM, CASP+ CE, or CISSP.
• We expect hands-on ACAS experience, including running scans, analyzing vulnerability data, and maintaining asset inventories in Nessus or Tenable.sc; a current DISA ACAS Operator/Admin training certificate is highly desirable.
• We require deep expertise in DoD RMF, NIST SP 800-53, SP 800-37, SP 800-171, and DISA STIG implementation.
• We need proven experience handling ATO artifacts in eMASS or Xacta, plus proficiency with SCC, STIG Viewer, and interpreting IAVA/IAVM notices.
• We value exceptional written and verbal communication skills, including the ability to serve as a security liaison while balancing strict compliance requirements with a fast-moving R&D mission.

• We oversee RMF lifecycle activities, including developing and maintaining authorization packages such as SSP, SAR, RAR, SAP, and POA&M in systems of record like eMASS and Xacta.
• We run credentialed and non-credentialed ACAS scans across connected and air-gapped environments, then analyze results to identify vulnerabilities, measure risk, and confirm compliance.
• We translate scan outputs and DISA STIG findings into practical remediation guidance, partnering with administrators and researchers to resolve issues and close POA&M items.
• We implement and manage continuous monitoring programs by reviewing ACAS dashboards, audit logs, and system configurations to verify ongoing adherence to NIST SP 800-53 controls.
• We support secure operations in air-gapped and multi-enclave environments, including manual ACAS feed updates, secure transfers, and compliance validation for isolated and classified networks.
• We perform routine security assessments using tools such as SCC, STIG Viewer, and Evaluate-STIG, and we help support third-party evaluations and ATO control checks.
• We coordinate with the ISSM and incident response teams to investigate security events, audit irregularities, and potential classified data spills.

• IAM
• Support
• SAP
• Security
• Ada
• Splunk

More:

We are Apavo, a cybersecurity company supporting military, defense, and critical infrastructure clients. Our team is built around quality, open communication, and a culture where every voice matters. We value work-life balance and a growth mindset, and we offer the opportunity to make a meaningful impact in cybersecurity while developing professionally in a supportive environment. This is an on-site, full-time, non-exempt role based in Arlington, VA, supporting DARPA across complex, multi-enclave IT and R&D environments at all classification levels, including Unclassified, Secret, TS/SCI, and Special Access Programs.

last updated 34 week of 2026