Job Title: Information Systems Security OfficerJob DescriptionThe Information Systems Security Officer will lead cybersecurity efforts for complex software projects within a United States Department of Defense (DoD) environment, with a strong focus on Risk Management Framework (RMF) compliance and secure cloud-based workloads. This role drives the creation, submission, and maintenance of security packages and authorizations, including obtaining and sustaining Authorization to Operate (ATO) for Amazon Web Services (AWS) container-based solutions. The position requires deep expertise in DoD cybersecurity processes, tools, and standards, as well as strong communication and collaboration skills across engineering, cybersecurity, business, and customer stakeholders.Responsibilities
- Serve as an Information Systems Security Engineer (ISSE) for DoD software projects, providing cybersecurity leadership and guidance across the full system lifecycle.
- Generate and submit complete System Security Packages (SSPs), Plans of Action and Milestones (POA&Ms), and other required artifacts to support DoD Risk Management Framework (RMF) and Security Technical Implementation Guide (STIG) processes.
- Apply DoD cybersecurity tools, including eMASS and STIG Viewer, to build, manage, and validate security packages and supporting documentation.
- Obtain and maintain at least one DoD Authorization to Operate (ATO) for AWS-deployed container-based workloads, ensuring ongoing compliance with DoD security requirements.
- Inform and define software mitigation requirements based on results from static application security testing (SAST) tools such as SonarQube and container scanning tools such as Trivy.
- Recommend and validate data protection mechanisms, including encryption and access control strategies, to safeguard sensitive information in deployed workloads.
- Test and verify security controls to ensure they function as designed and effectively reduce risk across applications and infrastructure.
- Conduct threat modeling activities to identify potential attack vectors and prioritize security mitigations for software systems and cloud workloads.
- Lead vulnerability management activities, including identifying, tracking, and coordinating remediation of security findings across development and operations teams.
- Monitor the security posture of deployed workloads, leveraging appropriate tools and processes to detect and respond to anomalous or malicious activity.
- Collaborate effectively with engineering, cybersecurity, business, and customer stakeholders throughout the RMF cybersecurity lifecycle, ensuring clear communication of risks, requirements, and progress.
- Provide security guidance and input to DevSecOps teams across multiple software releases, helping integrate security best practices into continuous integration and deployment processes.
- Use system security tools such as Wiz or eMASSter to support security posture assessment, reporting, and ongoing compliance activities.
- Contribute to the design and operation of Security Operations Center (SOC) functions, using tools such as Splunk or CloudWatch to support monitoring and incident response.
- Leverage AWS security services, including Security Hub and GuardDuty, to strengthen detection, response, and compliance capabilities in cloud environments.
- Apply knowledge of CIS benchmarks and other industry security standards to align system configurations and controls with recognized best practices.
- Support or coordinate activities related to penetration testing, fuzz testing, and dynamic application security testing (DAST), and use results to drive remediation and improvement.
- Document security requirements, decisions, and outcomes clearly and comprehensively to support audits, assessments, and continuous improvement.
Essential Skills
- At least 5 years of experience serving as an Information Systems Security Engineer (ISSE) for United States Department of Defense (DoD) software projects.
- Proven experience generating and submitting System Security Packages (SSPs), Plans of Action and Milestones (POA&Ms), and other artifacts required for DoD Risk Management Framework (RMF) and Security Technical Implementation Guide (STIG) processes.
- Hands-on experience applying DoD cybersecurity tools such as eMASS and STIG Viewer to develop and manage security packages.
- Demonstrated success obtaining and maintaining at least one DoD Authorization to Operate (ATO) for an AWS-deployed container-based workload.
- Strong background in cyber security, including threat modeling, vulnerability management, security monitoring, and data protection for deployed workloads.
- Experience informing software mitigation requirements based on output from static application security testing (SAST) tools such as SonarQube.
- Experience using container scanning tools such as Trivy to identify and remediate vulnerabilities in containerized workloads.
- Demonstrated expertise in recommending and validating data protections and testing security controls for complex systems.
- Track record of effective communication and collaboration throughout the RMF cybersecurity lifecycle with engineering, cybersecurity, business, and customer stakeholders.
- Possession of one or more relevant cybersecurity certifications, such as CISSP, CASP, or Security+.
Additional Skills & Qualifications
- Experience with United States Intelligence Community (IC) system cybersecurity processes and tools.
- background in establishing or operating Security Operations Center (SOC) functions, including use of tools such as Splunk or CloudWatch.
- Hands-on experience with AWS security services, such as Security Hub and GuardDuty, to enhance cloud security monitoring and compliance.
- Experience serving as an ISSE on a DevSecOps team through multiple software releases, integrating security into continuous delivery pipelines.
- Familiarity with system security tools such as Wiz or eMASSter for posture assessment and compliance tracking.
- Knowledge of CIS benchmarks and other industry security standards, and the ability to apply them to system hardening and configuration.
- Exposure to penetration testing, fuzz testing, and dynamic application security testing (DAST) tools and techniques, with the ability to interpret results and support remediation.
Work EnvironmentThe role focuses on securing DoD and cloud-based software workloads, particularly AWS-deployed container environments, using a range of cybersecurity tools, frameworks, and industry standards. You will work closely with engineering, cybersecurity, business, and customer stakeholders in a collaborative setting that values clear communication and thorough documentation. The environment emphasizes adherence to DoD RMF, STIG requirements, and ATO processes, and makes extensive use of tools such as eMASS, STIG Viewer, SonarQube, Trivy, Wiz, eMASSter, Splunk, CloudWatch, and AWS security services like Security Hub and GuardDuty. The position supports a culture of continuous improvement in security posture, integration with DevSecOps practices, and proactive monitoring and vulnerability management across deployed workloads. Dress code and specific onsite or remote arrangements are determined by organizational policies and project needs. Job Type & LocationThis is a Contract position based out of Annapolis, MD. Pay and BenefitsThe pay range for this position is $150000.00 - $170000.00/hr. Individual compensation offered for this position within this range will depend on many factors, including qualifications, skills, relevant experience, job knowledge, geographic location, internal equity, and other pertinent job-related factors.Eligibility requirements apply to some benefits and may depend on your job classification and length of employment. Benefits are subject to change and may be subject to specific elections, plan, or program terms. If eligible, the benefits
available for this temporary role may include the following:
Medical, dental & vision Critical Illness, Accident, and Hospital 401(k) Retirement Plan Pre-tax and Roth post-tax contributions available Life Insurance (Voluntary Life & AD&D for the employee and dependents) Short and long-term disability Health Spending Account (HSA) Transportation benefits Employee Assistance Program Time Off/Leave (PTO, Vacation or Sick Leave) Job Type & LocationThis is a Contract position based out of Annapolis, MD. Application DeadlineThis position is anticipated to close on Nov 6, 2026. Workplace TypeThis is a hybrid position in Annapolis,MD.About Actalent
Actalent is a global leader in engineering and sciences services and talent solutions. We help visionary companies advance their engineering and science initiatives through access to specialized experts who drive scale, innovation and speed to market. With a network of almost 20,000 consultants and 5,000 clients across the U.S., Canada, Asia and Europe, Actalent serves many of the Fortune 500. We are proud to be an Engineering News-Record (ENR) Top 500 Design Firm for our engineering design services and a ClearlyRated Best of Staffing® winner for both client and talent service.
The company is an equal opportunity employer and will consider all applications without regard to race, sex, age, color, religion, national origin, veteran status, disability, sexual orientation, gender identity, genetic information or any characteristic protected by law.
If you would like to request a reasonable accommodation, such as the modification or adjustment of the job application process or interviewing process due to a disability, please email actalentaccommodation@actalentservices.com for other accommodation options.
San Francisco Fair Chance Ordinance:
Pursuant to the San Francisco Fair Chance Ordinance, for all positions located in the city and county of San Francisco, we will consider for employment qualified applicants with arrest and conviction records.
Massachusetts Lie Detector:
It is unlawful in Massachusetts to require or administer a lie detector test as a condition of employment or continued employment. An employer who violates this law shall be subject to criminal penalties and civil liability.
Use of Artificial Intelligence (AI):
We may use Artificial Intelligence (AI) to support parts of our hiring process, including sourcing, screening, and evaluating candidates. AI helps assess applications and qualifications, but final decisions are made by our hiring team. By applying, you acknowledge and agree that your application may be reviewed using AI tools.