Job Requirements
Reston, VA
Top Secret/SCI CI Polygraph
Career Level not specified
Salary not specified
Join Premium to unlock estimated salaries 
Job Description
Job Description
acuCyber is seeking an Information Systems Security Officer (ISSO) to support the authorization and ongoing security of mission applications, cloud infrastructure, and enterprise core services. The ISSO will work with Government security personnel, software developers, and infrastructure engineers to maintain security documentation, assess risk, and ensure systems meet applicable Department of Defense and Intelligence Community requirements.
This role requires someone who can connect security requirements to how systems are built and operated. Candidates should be comfortable reviewing technical evidence, investigating compliance gaps, and working with engineers to resolve findings as software, infrastructure, and system configurations change.
This is a full-time, on-site role at a Government facility in Charleston, SC or the National Capital Region (NCR).
What You'll Do:
• Support Risk Management Framework (RMF) activities to obtain and maintain Authority to Operate (ATO) for systems across applicable classification levels.
• Develop and maintain authorization documentation, including System Security Plans (SSPs), security control implementation statements, system boundary descriptions, and supporting evidence.
• Coordinate with system owners, Information System Security Managers (ISSMs), assessors, and engineering teams to prepare authorization packages and resolve assessment findings.
• Maintain Plans of Action and Milestones (POA&Ms), track remediation progress, and communicate unresolved risks and dependencies.
• Use the DISA Enterprise Mission Assurance Support Service (eMASS) to maintain authorization records, security control documentation, assessment evidence, and remediation status, as applicable.
• Review Assured Compliance Assessment Solution (ACAS) scan results, security configuration assessments, and application security testing reports; work with technical teams to prioritize and validate remediation.
• Assess the security impact of software releases, infrastructure changes, new integrations, and changes to the authorization boundary.
• Support continuous monitoring by maintaining current security evidence, reviewing control effectiveness, and reporting changes in system risk.
• Work with cloud and DevSecOps engineers to incorporate security requirements and evidence collection into development and deployment workflows.
• Review access controls, privileged access, audit logging, configuration baselines, and protection of sensitive data.
• Support security incident reporting, investigation, corrective actions, and updates to relevant documentation and procedures.
• Apply appropriate security overlays and support supply chain risk management activities.
• Prepare security status reports and brief Government stakeholders on authorization progress, findings, and remediation priorities.
Required Skills
• Bachelor's degree in a technical or managerial discipline
• Five (5) or more years of practical experience in cybersecurity, engineering, Test and Evaluation (T&E), or Assessment and Authorization (A&A), formerly Certification and Accreditation (C&A).
• In lieu of a college degree, a high school diploma or high school equivalency certificate and more than seven (7) years of practical experience in the fields listed above.
• Active Top Secret/Sensitive Compartmented Information (TS/SCI) clearance with a Counterintelligence (CI) Polygraph.
• Prior experience supporting the Intelligence Community.
• Experience using information assurance tools, including eMASS and ACAS.
• Experience performing ISSO duties or comparable information systems security and authorization responsibilities.
• Experience supporting RMF activities and developing or maintaining system authorization packages.
• Experience documenting security control implementation, collecting assessment evidence, and tracking findings through resolution.
• Understanding of applicable Department of War and Intelligence Community security requirements and assessment processes.
• Experience reviewing vulnerability assessments and security configuration findings and coordinating remediation with technical personnel.
• Understanding of system boundaries, data flows, access controls, audit logging, configuration management, and continuous monitoring.
• Ability to assess the security implications of system changes and explain risks to technical and nontechnical stakeholders.
• Strong technical writing, organizational, and communication skills.
• Ability to meet applicable cybersecurity workforce qualification requirements for the assigned position. A Full Security Control Assessor qualification may also be required, depending on assigned duties.
Desired Skills
• Meet DoD 8140 / 8570 IAM Level II or III baseline requirements (such as CISSP, CISM, CAP/ISC2 CGRC).
• IC authorization experience: Experience supporting authorization activities under Intelligence Community Directive (ICD) 503 and applicable agency guidance.
• Cloud security: Experience assessing Amazon Web Services (AWS) or AWS GovCloud environments, including deployments subject to Department of Defense Impact Level 5 requirements.
• Container platforms: Familiarity with Kubernetes and Red Hat OpenShift security considerations, including workload isolation, access controls, image security, and logging.
• DevSecOps: Experience using automated security testing results and deployment records as evidence supporting assessment and continuous monitoring.
• Security assessments: Experience applying Security Technical Implementation Guides (STIGs), validating configuration compliance, and supporting security control assessments.
• Identity and data protection: Familiarity with Identity, Credential, and Access Management (ICAM), Public Key Infrastructure (PKI), certificate management, encryption, and secrets management.
• Zero Trust: Experience assessing controls involving identity, devices, networks, applications, and data.
• Relevant certifications: Certified in Governance, Risk and Compliance (CGRC), Certified Information Systems Security Professional (CISSP), or comparable credentials.
acuCyber is seeking an Information Systems Security Officer (ISSO) to support the authorization and ongoing security of mission applications, cloud infrastructure, and enterprise core services. The ISSO will work with Government security personnel, software developers, and infrastructure engineers to maintain security documentation, assess risk, and ensure systems meet applicable Department of Defense and Intelligence Community requirements.
This role requires someone who can connect security requirements to how systems are built and operated. Candidates should be comfortable reviewing technical evidence, investigating compliance gaps, and working with engineers to resolve findings as software, infrastructure, and system configurations change.
This is a full-time, on-site role at a Government facility in Charleston, SC or the National Capital Region (NCR).
What You'll Do:
• Support Risk Management Framework (RMF) activities to obtain and maintain Authority to Operate (ATO) for systems across applicable classification levels.
• Develop and maintain authorization documentation, including System Security Plans (SSPs), security control implementation statements, system boundary descriptions, and supporting evidence.
• Coordinate with system owners, Information System Security Managers (ISSMs), assessors, and engineering teams to prepare authorization packages and resolve assessment findings.
• Maintain Plans of Action and Milestones (POA&Ms), track remediation progress, and communicate unresolved risks and dependencies.
• Use the DISA Enterprise Mission Assurance Support Service (eMASS) to maintain authorization records, security control documentation, assessment evidence, and remediation status, as applicable.
• Review Assured Compliance Assessment Solution (ACAS) scan results, security configuration assessments, and application security testing reports; work with technical teams to prioritize and validate remediation.
• Assess the security impact of software releases, infrastructure changes, new integrations, and changes to the authorization boundary.
• Support continuous monitoring by maintaining current security evidence, reviewing control effectiveness, and reporting changes in system risk.
• Work with cloud and DevSecOps engineers to incorporate security requirements and evidence collection into development and deployment workflows.
• Review access controls, privileged access, audit logging, configuration baselines, and protection of sensitive data.
• Support security incident reporting, investigation, corrective actions, and updates to relevant documentation and procedures.
• Apply appropriate security overlays and support supply chain risk management activities.
• Prepare security status reports and brief Government stakeholders on authorization progress, findings, and remediation priorities.
Required Skills
• Bachelor's degree in a technical or managerial discipline
• Five (5) or more years of practical experience in cybersecurity, engineering, Test and Evaluation (T&E), or Assessment and Authorization (A&A), formerly Certification and Accreditation (C&A).
• In lieu of a college degree, a high school diploma or high school equivalency certificate and more than seven (7) years of practical experience in the fields listed above.
• Active Top Secret/Sensitive Compartmented Information (TS/SCI) clearance with a Counterintelligence (CI) Polygraph.
• Prior experience supporting the Intelligence Community.
• Experience using information assurance tools, including eMASS and ACAS.
• Experience performing ISSO duties or comparable information systems security and authorization responsibilities.
• Experience supporting RMF activities and developing or maintaining system authorization packages.
• Experience documenting security control implementation, collecting assessment evidence, and tracking findings through resolution.
• Understanding of applicable Department of War and Intelligence Community security requirements and assessment processes.
• Experience reviewing vulnerability assessments and security configuration findings and coordinating remediation with technical personnel.
• Understanding of system boundaries, data flows, access controls, audit logging, configuration management, and continuous monitoring.
• Ability to assess the security implications of system changes and explain risks to technical and nontechnical stakeholders.
• Strong technical writing, organizational, and communication skills.
• Ability to meet applicable cybersecurity workforce qualification requirements for the assigned position. A Full Security Control Assessor qualification may also be required, depending on assigned duties.
Desired Skills
• Meet DoD 8140 / 8570 IAM Level II or III baseline requirements (such as CISSP, CISM, CAP/ISC2 CGRC).
• IC authorization experience: Experience supporting authorization activities under Intelligence Community Directive (ICD) 503 and applicable agency guidance.
• Cloud security: Experience assessing Amazon Web Services (AWS) or AWS GovCloud environments, including deployments subject to Department of Defense Impact Level 5 requirements.
• Container platforms: Familiarity with Kubernetes and Red Hat OpenShift security considerations, including workload isolation, access controls, image security, and logging.
• DevSecOps: Experience using automated security testing results and deployment records as evidence supporting assessment and continuous monitoring.
• Security assessments: Experience applying Security Technical Implementation Guides (STIGs), validating configuration compliance, and supporting security control assessments.
• Identity and data protection: Familiarity with Identity, Credential, and Access Management (ICAM), Public Key Infrastructure (PKI), certificate management, encryption, and secrets management.
• Zero Trust: Experience assessing controls involving identity, devices, networks, applications, and data.
• Relevant certifications: Certified in Governance, Risk and Compliance (CGRC), Certified Information Systems Security Professional (CISSP), or comparable credentials.
group id: 91120692