Information Systems Security Officer

Zachary Piper Solutions is seeking an Information System Security Officer (ISSO) to support a federal and DoD cybersecurity mission. The ISSO will support the implementation, execution, and sustainment of RMF activities across secure information systems and cloud-based environments. This position focuses on hands-on cybersecurity authorization, security control implementation, eMASS documentation, vulnerability management, and continuous monitoring to maintain secure and authorized systems supporting federal and defense missions. The ISSO will work closely with ISSMs, ISSEs, system owners, engineers, & government stakeholders to support ATO packages, cybersecurity assessments, and ongoing authorization activities. The ideal candidate has hands-on DoD RMF experience, strong eMASS expertise, and a demonstrated ability to maintain security authorization documentation and remediate cybersecurity findings in complex federal environments.

Responsibilities of the ISSO include:

• Execute and support the RMF lifecycle in accordance with NIST SP 800-37 & applicable DOD cybersecurity requirements
• Develop, maintain, & update SSPs, security control narratives, authorization artifacts, & supporting cybersecurity documentation
• Support the development, submission, maintenance, and sustainment of ATO packages using eMASS
• Implement, assess, and document security controls in accordance with NIST SP 800-53 and applicable DoD security control baselines
• Maintain POA&Ms, including vulnerability tracking, remediation milestones, corrective actions, and closure evidence
• Conduct ConMon activities to maintain system authorization and security compliance
• Review and analyze vulnerability assessment results from ACAS, Tenable Nessus, and other security scanning tools
• Support DISA STIG compliance, vulnerability remediation, patch management, and security hardening activities
• Identify security weaknesses, assess risks, coordinate remediation, and document corrective actions with system administrators and engineering teams
• Support security control assessments, evidence collection, testing, and validation activities in coordination with SCAs
• Maintain authorization boundaries, system inventories, ports, protocols, services, and cybersecurity documentation supporting system security posture
• Support security impact analyses and cybersecurity reviews associated with system changes, technology refreshes, migrations, and infrastructure modifications
• Assist with security categorization, control implementation, assessment, authorization, and ongoing authorization activities
• Coordinate with ISSMs, ISSEs, system owners, government stakeholders, and Authorizing Officials to support authorization requirements and resolve cybersecurity deficiencies
• Support cybersecurity incident response, vulnerability investigations, and security-related change management activities
• Maintain cybersecurity policies, procedures, standard operating procedures (SOPs), and operational documentation
• Support audit readiness, compliance reviews, and cybersecurity assessments across federal and DoD environments
• Support cloud security authorization activities and cybersecurity control mapping for AWS GovCloud and other cloud-based environments
• Assist with cybersecurity evidence collection and control mapping supporting cloud-native systems, containers, Kubernetes, and CI/CD environments
• Maintain accurate authorization records, security artifacts, vulnerability documentation, and compliance reporting within eMASS and other applicable GRC platforms

Qualifications of the ISSO include:

• 3-5+ years of hands-on experience supporting DoD cybersecurity, IA, RM), or security authorization activities
• Direct experience serving as an ISSO or performing equivalent hands-on security authorization responsibilities
• Strong hands-on experience with eMASS, including maintaining authorization packages, security artifacts, control implementation documentation, and POA&Ms
• Experience supporting the DoD RMF authorization lifecycle, including security categorization, control implementation, assessment, authorization, and continuous monitoring
• Practical experience implementing, assessing, documenting, and maintaining NIST SP 800-53 security controls
• Experience developing and maintaining SSPs, security control narratives, POA&Ms, and authorization documentation
• Experience supporting ATO authorization, ATO sustainment, ongoing authorization, and continuous monitoring activities
• Experience reviewing and remediating cybersecurity vulnerabilities, including ACAS/Nessus findings, DISA STIGs, and security control deficiencies
• Familiarity with DISA security requirements, DoD cybersecurity policies, vulnerability management, and security compliance processes
• Ability to coordinate with ISSMs, ISSEs, system administrators, system owners, and government cybersecurity stakeholders
• Active IAMI or IATII certification (or able to obtain within 90 days)
• Active Secret Clearance

Preferred Qualifications of the ISSO include:

• Experience supporting AWS GovCloud authorization packages, particularly IL4, IL5, or IL6 environments
• Experience supporting cloud security authorization, cloud control implementation, or cloud security documentation
• Familiarity with AWS security services, cloud security controls, and cloud authorization boundaries
• Experience supporting containers, Kubernetes, CI/CD pipelines, DevSecOps environments, or continuous authorization initiatives
• Experience with additional GRC platforms such as Xacta, RegScale, CSAM, or ServiceNow GRC
• Experience with DISA Cloud Security Requirements Guide (SRG), FedRAMP, or cloud security compliance frameworks
• Experience with SIAs, significant change reviews, and authorization boundary updates
• Experience supporting SCAs, SARs, & SAPs
• Experience with vulnerability management tools such as ACAS, Tenable Nessus, SCAP Compliance Checker, or similar platforms
• Experience supporting classified DoD systems, federal information systems, or defense cybersecurity programs
• Experience supporting cybersecurity automation, compliance evidence generation, or automated security control monitoring
• Experience with cybersecurity incident response, security investigations, and remediation coordination
• Experience supporting cybersecurity modernization, cloud migration, or system lifecycle activities
• Strong written communication, documentation, analytical, and organizational skills
• Ability to work collaboratively across cybersecurity, engineering, and government teams

Compensation for the ISSO includes:

• Salary Range: $150,000-170,000 **depending on experience**
• Benefits including an a nnual bonus (10%), equity opportunities me dical benefits (100% employer-paid), unlimited PTO, paid federal holidays, home-office stipend, and more

Keywords: Information System Security Officer, ISSO, Cybersecurity, Information Assurance, IA, DoD Cybersecurity, Federal Cybersecurity, RMF, Risk Management Framework, NIST RMF, NIST SP 800-37, NIST 800-37, NIST SP 800-53, NIST 800-53 Rev 5, Security Controls, Security Control Implementation, Security Control Assessment, Security Control Testing, A&A, Assessment and Authorization, Authorization to Operate, ATO, ATO Packages, ATO Sustainment, Ongoing Authorization, Continuous Monitoring, ConMon, eMASS, eMASS Packages, eMASS Documentation, Security Authorization, Security Authorization Packages, Security Authorization Lifecycle, System Security Plan, SSP, Security Control Narratives, Security Assessment Report, SAR, Security Assessment Plan, SAP, Risk Assessment Report, RAR, Plan of Action and Milestones, POA&M, POAM, Vulnerability Management, Vulnerability Assessment, Vulnerability Remediation, ACAS, Tenable, Tenable Nessus, Nessus, STIG, DISA STIG, SCAP, SCAP Compliance Checker, IAVM, Patch Management, Security Hardening, Configuration Management, Security Configuration Management, Continuous Monitoring, Security Compliance, Cybersecurity Compliance, Audit Readiness, Security Documentation, Cybersecurity Documentation, RMF Step 1, RMF Step 2, RMF Step 3, RMF Step 4, RMF Step 5, RMF Step 6, Security Categorization, Control Selection, Control Implementation, Control Assessment, Authorization, Security Evidence, Control Evidence, Security Findings, Corrective Actions, Security Weaknesses, Security Deficiencies, Security Risk, Risk Mitigation, Risk Management, Security Impact Analysis, SIA, Significant Change Review, Authorization Boundary, Security Boundary, System Inventory, Ports Protocols and Services, PPSM, Ports Protocols Services and Mechanisms, Cloud Security, AWS Security, AWS GovCloud, GovCloud, IL4, IL5, IL6, Cloud Authorization, Cloud RMF, Cloud Security Controls, Cloud Security Compliance, Cloud Security Documentation, Cloud Security Architecture, Cloud Workloads, Cloud Infrastructure, Cloud Migration, FedRAMP, DISA Cloud SRG, Cloud Security Requirements Guide, Kubernetes, Containers, Container Security, CI/CD, DevSecOps, Continuous ATO, cATO, Security Automation, Compliance Automation, GRC, Governance Risk and Compliance, Xacta, RegScale, CSAM, ServiceNow GRC, Security Control Assessor, SCA, Security Control Assessment, Security Assessment, Security Testing, ST&E, Security Test and Evaluation, Security Validation, AO, Authorizing Official, ISSM, Information System Security Manager, ISSE, Information System Security Engineer, System Owner, System Administrator, Government Stakeholders, DoD RMF, Department of Defense, U.S. Navy, Federal Information Systems, Classified Systems, Secret Clearance, Active Secret, Fully Adjudicated Secret, DoD 8570, DoD 8140, IAM Level I, IAT Level II, Security+, CISSP, CASP+, Cybersecurity Analyst, Cybersecurity Engineer, Cybersecurity Specialist, Information Security Analyst, Information Security Officer, Security Compliance Analyst, RMF Analyst, A&A Analyst, eMASS Analyst, Federal RMF, Defense Cybersecurity, Mission Assurance, Security Posture, Cybersecurity Risk, Security Operations, Incident Response, Security Incident Management, Technical Documentation, Security Procedures, SOPs, Security Policies, Risk Control Assurance, Cybersecurity Modernization, Continuous Authorization, Cybersecurity Readiness, Cybersecurity Reporting, Risk Reporting, Security Governance, Federal Compliance, DoD Compliance, Government Security, Cleared Cybersecurity, DC, Washington DC, Maryland, Virginia, Denver, Colorado Springs

#LI-SW1

#LI-REMOTE